<br><br><div class="gmail_quote">On Mon, Aug 15, 2011 at 1:29 PM, Seth Hall <span dir="ltr"><<a href="mailto:seth@icir.org" target="_blank">seth@icir.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><br>
On Aug 15, 2011, at 1:09 PM, Jim Mellander wrote:<br>
<br>
> We like setting record_state_history=T to record the flags that were seen during the connection, and found that the connection compressor didn't play nicely with that, in some cases.<br>
<br>
</div>Sounds like more evidence for removing the conn compressor if possible. Also, state history is included in the new conn logs by default.</blockquote><div><br></div><div>Not to pile on...</div><div><br></div><div>I disable the CC in some cases where i need better timing on connections. With CC enabled, it discards some of the duplicate packets. I may be in the minority though, I am not using Bro as an IDS. I use it as an analytical tool in my case.</div>
<div><br></div><div> Sridhar </div></div>