Origin data

Zeek
1

hi,

when I try to capture the connection data, my origin data is not captured. In wireshark it works. What is the problem? some kind of bro configuration?

-rw-r–r-- 1 183 oct 25 11:49 contents_X_resp.dat
-rw-r–r-- 1 0 oct 25 11:49 contents_X_orig.dat <---- 0 bytes
-rw-r–r-- 1 183 oct 25 11:49 contents_X_resp.dat
-rw-r–r-- 1 0 oct 25 11:49 contents_X_orig.dat <---- 0
-rw-r–r-- 1 183 oct 25 11:49 contents_X_resp.dat
-rw-r–r-- 1 0 oct 25 11:49 contents_X_orig.dat <---- 0
-rw-r–r-- 1 2,8K oct 25 11:50 contents_X_resp.dat

Also, in http.log, doesn’t appear the parameters, method, uri,host

1508923559.491507 CdS3HN1j2ou0LUObRb X 59772 X 80 1 - - - - 1.1 - 0 4685 200 OK - - (empty) - – - - - F152dj2pHXhPN1wXng - image/jpeg

2

How are you declaring that you want to capture contents?

  .Seth

3

Yes,

https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums