Is there any reason to expect Bro to give inconsistent output when
running a script on trace files? I have a script that uses SumStats to
fire off an observation in the tcp_packet event to save the payload for
later analysis. I seem to be running into an issue where I count a
smaller number of observed tcp_packet events than I should actually be
seeing.
Hello Ben,
no, there is no reason to expect Bro to give inconsistent output when
running a script on a trace file.
Do you potentially have a minimal example that you construct where this
happens, either with a small trace, or with one of the traces in the Bro
test suite? Without an example it is a bit hard to guess what exactly
might be going wrong.
Johanna