Is Bro capable of reassembling DNS traffic that is being captured over a TX and a RX tap interface if they are bridged?
Regards,
Coen
If the TX and RX interfaces are bonded together, and bro pointed to that bonded interface rather than the individual ones, then it works fine. Bro never knows the difference, as the TX and RX are presented to it on the bonded interface. (I'm doing this right now...works well.)
aaron