[Bro] bro alerts over email

Vern Paxson vern at icir.org
Sun Mar 20 23:43:29 PST 2005


> reading_live_traffic() is defined in bro.bif.bro, but they way it was 
> being used there was
> a race condition where it was not always being set correctly.

Minor clarification: this isn't a race condition in terms of not being
deterministic.  Rather, the problem is that Bro doesn't know whether it's
reading live traffic until it finishes initializing global variables
(in particular, the "interfaces" variable); so a call to reading_live_traffic()
for a variable's initialization returns F even if later Bro determines
it indeed is going to be reading live traffic.

		Vern



More information about the Bro mailing list