Dear All,
I am new to Bro. I am testing the “event tcp_option ()”. However, the event is not invoked by the event engine. Can anyone kindly advise me what I have done wrong? My code is as follows.
Are you running this against a pcap? Are you maybe not running bro with the -C option to ignore invalid checksums from checksum offloading?
This works on when I try it on try.bro.org against the example caps:
event tcp_option (c:connection, is_orig:bool, opt:count, optlen:count){
print c$id$orig_h, is_orig, opt, optlen;
}