File Input Format

Dear all,
      I just used Bro recently. I have question about
using bro as off-line detector. The input file was
read by
bro -r filename
     According to the manual, the input file has to be
TCPdump format. I used the Information Exploration
Shootout database, but it didnot be read. The error
message "Improper format dump file" appeared on the
screen. For input file format,

Time Src.Srcport > Dst.Dstport Flag Seq1:Seq2 Ack Win
Buf Opt

How can Bro read this data? Can it read the CSV

Chaivat J.

Bro needs the tcpdump file in 'raw' format. ie the kind of file you get when
you use tcpdump with -w option.


Chaivat Jirapummin wrote: