Re: Capture Loss using pcap file

Vern Paxson <[email protected]> Thu, 10 Oct 2019 13:00:42 -0700

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<[email protected]>

Hi Eva,

> ... Is it a
> problem with Zeek like to much data or was the loss already in the pcap and
> has nothing to do with Zeek?

The loss was already in the pcap.  When running on pcaps, Zeek does not
drop any packets present in the pcap.

		Vern
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek