[Bro] rescan_state()?

Mike Sconzo sconzo at visiblerisk.com
Fri Sep 13 06:58:08 PDT 2013

I've been trying to play with persistent variables with the following:

module PTEST;

global a = 4 &persistent;

event bro_init()
    if ( rescan_state() )
        print "Success!";
    print a;

event bro_done()
    if ( checkpoint_state() )
        print "Success!";

event connection_state_remove(c: connection)
    a = 5;

but the "print a" always prints "4" (regardless of how many times I run
it), what am I missing? Any thoughts?

Bro is being run with bro -C -r test.pcap persistent.bro (from the same
directory each time, and I can see the .state/state.bst file being created.


cat ~/.bash_history > documentation.txt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130913/b9f5c123/attachment.html 

More information about the Bro mailing list