read trace offline

Zeek
1

Hi,I have a stupid question:Can I do an offline-analysis with Bro of a trace file in pcap form?thank you..

2

The Bro binary has the "-r" option similar to tcpdump for reading in pcap formatted tracefiles.

   .Seth