[Bro-Dev] Opinions on trace rewriter?

Robin Sommer robin at icir.org
Mon Oct 25 08:49:17 PDT 2010

What are the opinions on completely removing the trace rewriter from
the Bro code base? I think I vaguely remember us discussing this,
with a conclusion that removing is the way to go, but I wanted to

Pros of removing:

- Rewriter is broken right now anyway 

- Not used by many people (just the "occasional researcher" :-)

- Nobody knows the internals well.

- It's quite intrusive to the code, and removing it will get rid of
quite a bit of stuff sprinkled across the source. 


- It's pretty cool functionality and nobody else has it. 

I really like the rewriting but I'm thinking it would be better done
in an external tool than inside Bro itself. 


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the bro-dev mailing list