Capture Loss using pcap file

Eva Seipel <[email protected]> Mon, 7 Oct 2019 10:11:16 +0200

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<CAPoSYBedorGrUOyuAVOiDB98=JTK8VbbeckGa_kx_5e9HzaHKA@mail.gmail.com>

Dear all,

when I run Zeek/Bro (Version 2.6.3) against a rather large pcap file of
about 8GB (one from the CICIDS2017 dataset) I get values in between 17 and
65% in capture_loss.log. What could be the reason for that? I am pretty new
to the topic and couldn't find anything about that via search. Is it a
problem with Zeek like to much data or was the loss already in the pcap and
has nothing to do with Zeek?

Thank you.

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek