[Bro] Connection Events related to scan.bro

Robin Sommer robin at icir.org
Wed Apr 23 12:23:21 PDT 2008

On Tue, Apr 22, 2008 at 23:41 -0700, you wrote:

> Also, slightly unrelated, I noticed in the udp-common.bro, the code
> relating to "use_TRW_algorithm" is commented out... Is there a special
> reason for this?

There is some problem with the TRW implementation when used with UDP
traffic but I don't recall what exactly it was. The SVN log says:

    r3297 [...] Also, don't analyze UDP traffic, which currently is misaccounted.

Vern, do you remember what this was about?


Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list