# a odd problem

**URL:** <https://community.zeek.org/t/a-odd-problem/580>\
**Category:** Zeek\
**Created:** [September 17, 2004, 2:56pm UTC](https://community.zeek.org/t/a-odd-problem/580 "2004-09-17T14:56:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [September 17, 2004, 2:56pm UTC](https://community.zeek.org/t/a-odd-problem/580/1 "2004-09-17T14:56:59Z")

</div>

> &nbsp;&nbsp;&nbsp;&nbsp;I encounter a odd problem when i run \*bro\* today.
> 
> &nbsp;&nbsp;&nbsp;&nbsp;# ./bro my -w /home/zw/bro09171617.dump

Flags need to come before policy scripts. It's interpreting "-w" and  
"/home/zw/bro09171617.dump" as scripts to interpret. I would've expected  
it to stop by saying "error: can't open -w" (that's what it does for me),  
unless you happen to have a file "-w" in your Bro searchpath. Do you  
have such a file? Can you send me the tcpdump trace file, so I can see  
if I can reproduce this?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Cliff](https://avatars.discourse-cdn.com/v4/letter/c/b38774/32.png) [@Cliff](https://community.zeek.org/u/Cliff)\
**Post date:** [September 18, 2004, 7:07am UTC](https://community.zeek.org/t/a-odd-problem/580/2 "2004-09-18T07:07:36Z")

</div>

Hi Vern,  
&nbsp;&nbsp;&nbsp;&nbsp;I ran the following command,not set "-w" switch,and still generated the output.  
&nbsp;&nbsp;&nbsp;&nbsp;So I feel very confused.  
&nbsp;&nbsp;&nbsp;&nbsp;[cliff@oradata bro-pub-0.9a3]$ ./bro mt -i eth0  
&nbsp;&nbsp;&nbsp;&nbsp;input in flex scanner failed  
&nbsp;&nbsp;&nbsp;[cliff@oradata bro-pub-0.9a3]$ ./bro -i eth0 mt  
&nbsp;&nbsp;&nbsp;input in flex scanner failed

mt.bro is as follwoing:  
# $Id: mt.bro,v 1.1.1.1 2004/04/30 00:31:28 jason Exp $

@load log  
@load dns-lookup  
@load hot  
@load frag  
@load tcp  
@load scan  
@load weird  
@load finger  
@load ident  
@load ftp  
@load login  
@load portmapper  
@load ntp  
@load tftp

Thanks,  
Cliff

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/a-odd-problem/580/3 "2022-05-06T15:37:09Z")

</div>