[Bro] Smtp.log missing x-originating-ip

Seth Hall seth at icir.org
Tue Jan 19 12:53:36 PST 2016


> On Jan 19, 2016, at 1:12 PM, James Lay <jlay at slave-tothe-box.net> wrote:
> 
> I can see the field in full packet captures.  Any hints on what I'm 
> missing?  Thank you.

Could you privately send along a couple of headers that it's messing up?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/



More information about the Bro mailing list