Re: non_ip_packet_in_ethernet on a TCP three way handshake
"Johanna Amann" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hi Hui, Just to check the obvious - did you look at the trace in tcpdump/something else to check that it actually has correct ethernet headers, etc? Johanna On 24 Jun 2019, at 13:24, Hui Lin (Hugo) wrote: > Hi, > > I have a pcap containing only a TCP three way hand shake. When I tried > this > pcap in "try zeek" online with a simple tcp_packet event handler, > nothing > is print out and an non_ip_packet_in_ethernet warning is generated in > the > wierd log. Any idea what is going on? > > Best regards, > > Hui Lin > > > > > -- > Hui Lin > Ph.D. Candidate (http://hlin33.web.engr.illinois.edu/) > DEPEND (http://depend.csl.illinois.edu/) > ECE, Uni. of Illinois at Urbana-Champaign > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek