#903: -b turns off -f
---------------------+------------------------
Reporter: vern | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.2
Component: Bro | Version: git/master
Keywords: |
---------------------+------------------------
Running with -b (bare bones) disables processing by -f. Boy did this take
me a long time to figure out :-(.
Reproduce using the appended trace. Invoking with '''-e 'event
connection_established(c:connection) { print "yep"; }'''' will print
"yep". Invoking with that plus '''-f 'not tcp'''' won't print anything.
But invoking with '''-f 'not tcp' -b''' ''does'' print "yep".
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/903>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
#900: reference versions of startup scripts
------------------------+---------------------
Reporter: scampbell | Type: Problem
Status: new | Priority: Normal
Milestone: Bro2.2 | Component: bro-aux
Version: git/master | Keywords:
------------------------+---------------------
Would be handy to include a pair of general startup scripts for linux and
bsd. I realize this is a lesser problem in the big scheme of bro, but
standardizing on these things can be quite nice.
cheers
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/900>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
As I am aware, Bro has steadily moved toward a multi-threaded approach to
logging at the least. For an analyzer that I've been developing as part of
my research, I am curious to know if network_time remains coherent with the
network time given in pcap files and live capture. If not, is there a more
accurate variable available?
Of note: I've never really observed a discrepancy between the pcap files
and reported network time through the event system. Gilbert Clark and I had
a small discussion on this and I feel that from what I've seen in the
source code, network_time is likely fine, but I thought I'd get the answer
from the folk who know the source quite a bit better than I do.
Best,
--
James Swaro*
*
Internetworking Research Group
Ohio University
#892: topic/seth/dns-zero-responses-fix
---------------------------+------------------------
Reporter: seth | Owner: robin
Type: Merge Request | Status: new
Priority: Normal | Milestone: Bro2.2
Component: Bro | Version: git/master
Keywords: |
---------------------------+------------------------
This branch is in `bro`, `bro-testing`, and `bro-testing-private` and
implements a fix for a small issue in the base DNS script where DNS
requests where the response contained zero responses incorrectly
represented the situation.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/892>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
