[Bro] &expire_func/&create_expire question

Christian Kreibich christian at whoop.org
Fri Nov 17 16:37:15 PST 2006

We have some progress on the non-triggering of the expiration callback.
It is triggered, but a *long* time after the &create_expire interval.
Below are the timings using a 20 minute trace for this code:

function expire(t: table[count] of count, idx:count): interval
        print fmt("%s %s (expire)", current_time(), network_time());
        return 0 sec;

global state: table[count] of count &create_expire=1sec &expire_func=expire;
global idx: count = 0;

event new_packet(c: connection, p: pkt_hdr)
        state[idx] = idx;
        print fmt("%s %s", current_time(), network_time());

                          |   current_time()     network_time()
first packet processed    |  1163809190.13672   1039099587.68955
first expire cb triggered |  1163809190.75784   1039099678.4143

Real time is out, since 1s hasn't yet passed. But network time has
advanced 91s before I see the callback!? 


More information about the Bro mailing list