How should Bro to read wireshark trace file

Zeek
1

Hi All:

I am a new user, I have some trace files, which captured by using wireshark, when I use Bro to read it, I got the error message, which shows “fatal error: ./bro: problem with trace file alert1.pcap - alert1.pcap: No such file or directory” ,
or if I run “bro alert1 local”, I got “fatal error: ./bro: problem with trace file alert1 - unknown file format”

is anyone know how to solve this problem?

Thank you very much

Regards

Steven

2

You need to supply the pcap formatted trace file with the "-r" flag.

  bro -r alert1 local

  .Seth