[Zeek] non_ip_packet_in_ethernet on a TCP three way handshake

[Hui Lin (Hugo)]

Hi,

I have a pcap containing only a TCP three way hand shake. When I tried this
pcap in "try zeek" online with a simple tcp_packet event handler, nothing
is print out and an non_ip_packet_in_ethernet warning is generated in the
wierd log. Any idea what is going on?

Best regards,

Hui Lin




-- 
Hui Lin
Ph.D. Candidate (http://hlin33.web.engr.illinois.edu/)
DEPEND (http://depend.csl.illinois.edu/)
ECE, Uni. of Illinois at Urbana-Champaign
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20190624/f842137e/attachment.html