{"action":"opened","issue":{"url":"https://api.github.com/repos/jsiwek/test/issues/48","repository_url":"https://api.github.com/repos/jsiwek/test","labels_url":"https://api.github.com/repos/jsiwek/test/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/jsiwek/test/issues/48/comments","events_url":"https://api.github.com/repos/jsiwek/test/issues/48/events","html_url":"https://github.com/jsiwek/test/issues/48","id":360082408,"node_id":"MDU6SXNzdWUzNjAwODI0MDg=","number":48,"title":"find-filtered-trace could be a bit smarter","user":{"login":"jsiwek","id":422685,"node_id":"MDQ6VXNlcjQyMjY4NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/422685?v=4","gravatar_id":"","url":"https://api.github.com/users/jsiwek","html_url":"https://github.com/jsiwek","followers_url":"https://api.github.com/users/jsiwek/followers","following_url":"https://api.github.com/users/jsiwek/following{/other_user}","gists_url":"https://api.github.com/users/jsiwek/gists{/gist_id}","starred_url":"https://api.github.com/users/jsiwek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsiwek/subscriptions","organizations_url":"https://api.github.com/users/jsiwek/orgs","repos_url":"https://api.github.com/users/jsiwek/repos","events_url":"https://api.github.com/users/jsiwek/events{/privacy}","received_events_url":"https://api.github.com/users/jsiwek/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-13T22:01:36Z","updated_at":"2018-09-13T22:01:36Z","closed_at":null,"author_association":"OWNER","body":"Moved from https://bro-tracker.atlassian.net/browse/BIT-1919\n\nCreated by Vern Paxson at 2018-04-05T17:04:44.097-0500:\n> I fed Bro a pcap filtered to port 53 traffic.  It had a bunch of UDP activity, but the TCP activity was just scans.  This led to \"_The analyzed trace file was determined to contain only TCP control packets, which may indicate it's been pre-filtered.  By default, Bro reports the missing segments for this type of trace, but the 'detect_filtered_trace' option may be toggled if that's not desired._ being generated - misleading in this context.  In particular, the trace doesn't contain _only_ TCP control packets; rather, _of the TCP packets it contained, those were only control packets_.\r\n> \r\n> Seems the script could be smarter and if it sees UDP w/ payload, then not warn.\n\n"}}
{"actor":{"display_login":"jsiwek"}}