[Bro] how to get the oldest entry out of table

Christoph Göldi goeldich at ee.ethz.ch
Mon Feb 7 08:23:41 PST 2005


> > is it possible to get the oldest entry out of a table?
> For tables, I do not see a way other than iterating over all
> entries. But perhaps you can use a combination of tables and
> vectors; something like
>          type entry: record {
>               t: time;
>               c: count;
>          };
>          global test: table[addr] of vector of entry;
> Then you can keep the vector entries sorted by time.

is vector a new type which is not documented in the bro ref manual?
however, what you suggest doesn't solve my problem, because i have no
chance to expire and delete each entry in the table individually. i can only
delete all entries of one addr at the same time with the expire
attribut for tables.


More information about the Bro mailing list