I know that i can run bro -i eth0 -w .pcap . Is there a way broctl to also write to pcap file?
Hi,
in theory, you can pass arbitrary flags to Bro when it is called by
broctl, by setting BroArgs in broctl.cfg (see
https://www.bro.org/sphinx/components/broctl/README.html).
Note that writing pcap files with Bro has a few problems at the moment (I
think); I think it might corrupt packages under some circumstances. It
certainly is not a widely used feature and receives no testing at all.
Johanna