robin at icir.org
Mon Oct 16 16:19:02 PDT 2006
On Sun, Oct 15, 2006 at 19:53 +0200, you wrote:
> I'm still analyzing the inter-bro(1.1) communication :-)
Seems you're doing a thorough code review. :-)
> line 634/635 and 637/638 are identical:
> p->our_class = our_class ;
That's pretty certainly a left-over from merging in a patch at some
point. I'll get rid of the duplicate.
> - C still floods A,  and  are false and C can't be stopped. (?)
Yes, you're right. Like Christian, I'd be interested to know whether
you've run into this problem in practice.
As Christian also mentioned, shutting connections down is only kind
of an emergency break, lacking something more sophisticated at the
moment. However, one of your solutions (I'm tending towards [b])
might be worth implementing if this turns out to be problematic.
Thanks for pointing these things out!
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org
LBNL/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro