Lots of ContentGap Events

Zeek
1

Hello all,
I am a new user of Bro. I try to run it using a policy for calculating response time of web server( address of policy code: http://bro-ids.org/bro-contrib/network-analysis/akm-imc05/bro-scripts_v1.0.tar.gz )
I am using reduce.bro script which is attached to the email.

The problem is that I get lots of ContentGap errors when analyzing the attached dump file. The Notice file is also attached to the email.
Would you please let me know if you know what is the cause of ContentGap error ?
Thanks,
Raoofeh

reduce.bro (24.4 KB)

notice.log (4.72 KB)

test (35.5 KB)

2

Would you please let me know if you know what is the cause of ContentGap error ?

The problem is that the packets in your trace have invalid checksums.
If you run using -C (ignore checksum errors), then it works fine.

    Vern