tx_hosts and rx_hosts in files.log

Zeek
1

Hi,

If you use the PCAP below and analyze it using Bro:
https://www.bro.org/static/traces/email.pcap

Then when checking the files.log, the tx_hosts is supposed to show the host who transmitted the file, and rx_hosts is for the host who received the file based on Bro’s documentation: https://www.bro.org/sphinx-git/scripts/base/frameworks/files/main.bro.html

If you do the following:
cat files.log | bro-cut fuid tx_hosts rx_hosts | grep

You’ll get that the TX Host IP (SrcIP) is 192.168.121.176 and not 192.168.121.179 !!!

Is there something I’m doing wrong, or has bro switched their positions in the output?

​Thanks in advance,

Ali

2

Thanks for the bug report. Looks like this comes from the assumption made here:

https://github.com/bro/bro/blob/master/src/analyzer/protocol/mime/MIME.cc#L1459

–Vlad

3

You’re welcome. Hope it will be corrected soon.

4

Please file a ticket with our tracker.

Robin

5

Okay Robin, it’s done.

6

can any one tell me how to analyze dynamic protocol in bro i am beginner i just understand bro scripting and how to run please give me simple example thanks

Regards
USman