[Bro] &write_expire and sets

Christian Kreibich christian at whoop.org
Mon Jun 27 10:44:02 PDT 2005

Hi guys,

I was wondering what the semantics of &write_expire are for sets. For
example, in trw.bro I see

  global scan_sources: set[addr] &write_expire = 1 day;

The CHANGES file says that a *table* entry will be deleted if an entry
isn't written to within the specified timeframe. Sets obviously don't
have anything that can be written to other than the keys themselves, so
for sets, I presume write_expire means that an entry has to be re-
entered within the timeframe to avoid deletion?


More information about the Bro mailing list