truncated packets

Zeek
1

Dear All,

I know that Bro can analyze offline traffic with its -r option but I wonder if it can analyze the traffic contains truncated packets? I remember a few years ago when I run old versions of Bro on the MAWI traffic, it didn’t work properly since the packets were all truncated at 54 bytes. Maybe this has changed in the newer versions?

Regards
Laleh

2

You may try turning off the checksum verification.

3

See http://comments.gmane.org/gmane.comp.security.detection.bro/3168

4

Disabling checksum verification won't help much. You'll end up getting protocol violations because the protocol truncates so quickly. 54 bytes really doesn't give you much to work with. I assume you're just interested in getting connection logs?

  --Vlad

"The Bro list is public record anyway."

5

Disabling checksum verification won’t help much. You’ll end up getting protocol violations because the protocol truncates so quickly. 54 bytes really doesn’t give you much to work with. I assume you’re just interested in getting connection logs?

–Vlad

Yes… exactly. Is it possible to do so?

Laleh