udp_request and icmp_sent event handlers

Zeek
1

      I met a problem that event handlers udp_request, udp_reply, icmp_sent
doesn't work (i.e., they are not processed) when Bro read tcpdump data that
consist of udp and icmp packets. I did load udp and icmp analyzers. I noticed
that icmp_request and icmp_reply event handlers worked. Has anyone met
the same
problem?

udp.bro doesn't turn on a capture-all-UDP filter. So try adding

  redef capture_filters += { ["all udp"] = "udp" };

- Vern

2

Hi Vern,
    Thank you for your help. Yes, it works after I redef the capture_filters.
How about the icmp_sent event handler? Should the icmp_sent event handler see
all kinds of icmp packets?

Bing