[Bro] Using create_expire and expire_func

Vern Paxson vern at icir.org
Fri Apr 6 11:53:26 PDT 2012


>     print s;
> 
>     sleep(15);
> 
>     #s should be empty
>     print s;
> }
> ----------------------------------------------------------------------------
> in bro.bif
> -----------------------------------------------------------------------------
> function sleep%(time_secs: count%): any
>     %{
>     usleep(time_secs * 1000000);
>     return 0;
>     %}
>
> ...
>
> Why isn't 's' empty on second print?

Bro drives its evaluation of timers based on the clock advancing between
events.  The above code sequence doesn't include any subsequent event after
bro_init(), so the expiration timers don't have a chance to run.

		Vern



More information about the Bro mailing list