# Issue when Bro is reading a file which capturing live traffic

**URL:** <https://community.zeek.org/t/issue-when-bro-is-reading-a-file-which-capturing-live-traffic/3951>\
**Category:** Zeek\
**Created:** [December 24, 2015, 2:55am UTC](https://community.zeek.org/t/issue-when-bro-is-reading-a-file-which-capturing-live-traffic/3951 "2015-12-24T02:55:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hashem\_Alaidaros](https://avatars.discourse-cdn.com/v4/letter/h/ec9cab/32.png) [@Hashem\_Alaidaros](https://community.zeek.org/u/Hashem_Alaidaros)\
**Post date:** [December 24, 2015, 2:55am UTC](https://community.zeek.org/t/issue-when-bro-is-reading-a-file-which-capturing-live-traffic/3951/1 "2015-12-24T02:55:08Z")

</div>

Hi All,  
I run tcpdump live to capture the traffic into a file using “-w”.  
Then I run bro to read that file offline using “-r”.  
Both instances are running continuously. First it works fine but then bro stop generating results although it keep running, this means bro didn’t continue reading from the file. Is it because bro -r is faster than the live capturing?  
How to let bro keep reading the file (this file is continuously increasing)  
My bro version: 2.3 running on ubuntu platform.

Thanks

---

<div class="post-metadata">

**Author:** ![Franky](https://avatars.discourse-cdn.com/v4/letter/f/958977/32.png) [@Franky](https://community.zeek.org/u/Franky)\
**Post date:** [December 28, 2015, 2:02pm UTC](https://community.zeek.org/t/issue-when-bro-is-reading-a-file-which-capturing-live-traffic/3951/2 "2015-12-28T14:02:40Z")

</div>

Hi Hashem,

---

<div class="post-metadata">

**Author:** ![Hashem\_Alaidaros](https://avatars.discourse-cdn.com/v4/letter/h/ec9cab/32.png) [@Hashem\_Alaidaros](https://community.zeek.org/u/Hashem_Alaidaros)\
**Post date:** [December 29, 2015, 3:35am UTC](https://community.zeek.org/t/issue-when-bro-is-reading-a-file-which-capturing-live-traffic/3951/3 "2015-12-29T03:35:29Z")

</div>

Thanks Franky for your reply.  
in my research, I’m requested to run bro in offline mode for further analysis and forensics.

Any idea how to resolve the issue.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/issue-when-bro-is-reading-a-file-which-capturing-live-traffic/3951/4 "2022-05-06T15:43:18Z")

</div>