dump_packet and dump_current_packet ignores file name

Zeek
1

Hi.

I’m trying to dump each connection to a different file. E.g:

event new_packet(c: connection, p: pkt_hdr) {
dump_current_packet(c$uid + “.pcap”);
}

But bro writes all of the packets to the first “c$uid” and ignores the rest.

Looking at the source code (https://github.com/bro/bro/blob/091d1e163f687105bb6454d61252cbe4edae7d30/src/bro.bif#L3282-L3299), it seems that bro ignores “file_name” if “addl_pkt_dumper” already exists.

Reading the changelog (https://www.bro.org/download/CHANGES.bro.txt), it seems that “rotate_file_by_name” can be used to close “addl_pkt_dumper”, but it throws “can’t move x.pcap to x.pcap.17946.1255209915.175512.tmp: No such file or directory”.

How can I solve this?

2

Hi,

just to follow up - your pull request at
https://github.com/bro/bro/pull/132 has just been merged and this should
work now.

Johanna

3

Thanks!