[Bro] SMTP Data Fragmentation Problems

[Azoff, Justin S]

> On Aug 10, 2016, at 12:59 PM, Trevor Taubitz <tjtaubit at mtu.edu> wrote:
> 
> a receiving SMTP server with Bro running on it.

This sounds like it could be the common invalid checksum issue.  Is your reporter.log complaining about checksum errors?  See this link for more info and some possible fixes:

https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums

-- 
- Justin Azoff