[Bro] &expire_func/&create_expire question

Christian Kreibich christian at whoop.org
Fri Nov 17 14:51:03 PST 2006

Hey Mike,

mhmmm sorry but this seems to work here. For comparison, does this more
basic one give you output?

function expire(t: table[count] of count, idx:count): interval
        print fmt("Expiring %d", idx);
        return 0 sec;

global state: table[count] of count &create_expire=1sec &expire_func=expire;
global idx: count = 0;

event new_packet(c: connection, p: pkt_hdr)
        state[idx] = idx;

> Also, if you un-comment the test_key line at the top to use the 'time'
> type as a key in the table (and the corresponding key computation in
> the new_packet event), you get the following error:

That one I can confirm (and I don't understand the cause).


More information about the Bro mailing list