Hi all,
When I tried to test Bro in off-line with TCP dump file, I met
segmentation falut error.
The tcpdump was captured using "Targa2.c" with all supported attacks.
Also, I used the "my own.bro" in accordance with former mailing list
written by Vern about off-line test.
What I used command is as follows:
. /bro.cfg
./bro -r "dumpfile" "my own.bro"
refer to "my own.bro"
@load site
@load mt
@load tftp
@load dns
@load flag-irc
@load smtp-relay
@load software
@load ssh
@load worm
@load backdoor.bro
@load blaster.bro
@load flag-warez.bro
@load gnutella.bro
@load http-abstract.bro
@load http-body.bro
@load http-reply.bro
@load icmp.bro
@load ssl-worm.bro
@load stepping.bro
@load synflood.bro
Thanks
Taeshik