[Bro] File Extraction wierdness

[Seth Hall]

> On Feb 9, 2016, at 9:33 PM, Blake Mackey <Blake.Mackey at rmc.ca> wrote:
> 
> Is this normal behaviour? Or is Bro relatively bulletproof when it comes to file extraction?

Yes, it's generally functional.

> Could anyone suggest alternative things I can try to resolve this?

Could you capture some traffic that is giving you trouble and send it to me (offlist)?  It sounds to me like you're having packet loss issues, but I can't be sure without seeing the raw traffic.

Thanks
  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/