[Bro] Can Bro Worker read packet capture files

Paweł Piszczatowski pawelec93 at googlemail.com
Fri Mar 11 09:57:37 PST 2016


I've got a cluster setup with a manager and a worker. I have another VM
that I want to do a packet capture. I would like the Worker to run

"bro -r mypackets.trace local"

that then would add the extra data so it would show up in the manager.
However, there is no /logs/current folder in the Worker so where would I
have the files in order to pass it to the Manager ?

I don't want to go directly to the Manager, I would like the packet capture
to go through the worker first.

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160311/26aad676/attachment.html 


More information about the Bro mailing list