Greetings I am trying to use bro to read tcpdump files for the purposes of characterizing network traffic (not just that which is directed to the host). It has a more consistent output format than tcpdump, I'm going to want to do some filtering at some point, and it might be easier than trying …

What exactly do you mean by "everything"? As you compare Bro to tcpdump it sounds like you would like to see every packet. That does not really fit into Bro's connection-oriented model. Do you know ipsumdump[1]? Perhaps that could be more appropiate here? Robin [1] http://www.icir.org/kohler/ip…

> for how to make bro report _everything_? What exactly do you mean by "everything"? As you compare Bro to tcpdump it sounds like you would like to see every packet. That does not really fit into Bro's connection-oriented model. Do you know ipsumdump[1]? Perhaps that could be more appropiate he…

Reading _all_ packets

Zeek

Topic		Replies	Views
Bro on other Packet Trace Dumps. Zeek	13	206	May 6, 2022
Bro and Wireshark Zeek	3	86	May 6, 2022
dump files, loopback Zeek	1	125	May 6, 2022
store all packet Zeek	5	118	May 6, 2022
Capturing the raw trace... Zeek	7	195	May 6, 2022

Reading _all_ packets

Related topics