If you use the PCAP below and analyze it using Bro:
Then when checking the files.log, the tx_hosts is supposed to show the host who transmitted the file, and rx_hosts is for the host who received the file based on Bro’s documentation: https://www.bro.org/sphinx-git/scripts/base/frameworks/files/main.bro.html
If you do the following:
cat files.log | bro-cut fuid tx_hosts rx_hosts | grep
You’ll get that the TX Host IP (SrcIP) is 192.168.121.176 and not 192.168.121.179 !!!
Is there something I’m doing wrong, or has bro switched their positions in the output?
Thanks in advance,