non_ip_packet_in_ethernet on a TCP three way handshake
"Hui Lin (Hugo)" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAKq214nuop1SmFdcXWqqTKpwNY7eyYFgN50mcDaFJuzcqZLiWA@mail.gmail.com> |
Hi, I have a pcap containing only a TCP three way hand shake. When I tried this pcap in "try zeek" online with a simple tcp_packet event handler, nothing is print out and an non_ip_packet_in_ethernet warning is generated in the wierd log. Any idea what is going on? Best regards, Hui Lin -- Hui Lin Ph.D. Candidate (http://hlin33.web.engr.illinois.edu/) DEPEND (http://depend.csl.illinois.edu/) ECE, Uni. of Illinois at Urbana-Champaign _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek