<p dir="ltr">There are tons of incredibly useful features in Bro. Its always interesting to see the research papers those features came from. I'm referring to table expiring attributes in this case.<br>
<br>
Its also interesting to read that connection timers are only disabled at connection state removal. Are they periodically removed similar to hash table resizing in figure 3? In any case, it's smart that their removal comes second to packet processing.</p>
<p dir="ltr">-AK</p>
<div class="gmail_quote">On Sep 30, 2014 9:17 AM, "Vern Paxson" <<a href="mailto:vern@icir.org">vern@icir.org</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">> ... but if my quick skim is correct, this paper is where the old<br>
> load-level.bro script came from, right?<br>
<br>
Yes, basically. That paper documents a bunch of our experiences, including<br>
load-level. I think we wound up being torn between the need for it versus<br>
the notion "if you need it, what you really need is a bigger cluster".<br>
<br>
Vern<br>
_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro.org">bro-dev@bro.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
</blockquote></div>