brian field

thanks for the input. it's up to the moloch operator to determine what protocols and/or protocols+ports would be treated as sessionless. default is normal moloch behavior. info specified in the...

@StammesOpfer. Fyi I just submitted a PR to add ethernet support for moloch. My use case isn't arp related but i have a need for certain L2 protocols to be...

I'd be happy to put this into a new issue thread if it makes sense and others on moloch might be interested in this perspective. @awick. I get the value...

A bit more insight that may help identify the issue. Below shows the pcap of interest. Highlighted in blue is the pcap and size when it's malformed. and then above...