- http$host diff between bro and broctl

Zeek
1

Hi all,

Scenario 1 : bro instance on my local interface + browsing to www.bbc.com
Scenario 2 : bro cluster with a single Worker on my local interface + browsing to www.cnn.com

in http.log,
on the 1st scenario, the host field is initialized with www.bbc.com
on the 2nd scenario, the host field is NOT initialized

I’m running bro 2.5

Is there any explanation for the diff ?

thank you

B

2

You're probably starting bro differently in the two cases.

https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums

3

Thank you ! it turns out to be checksum

B