Siwek, Jonathan Luke
jsiwek at illinois.edu
Fri Sep 13 10:48:30 PDT 2013
> but the "print a" always prints "4" (regardless of how many times I run it), what am I missing? Any thoughts?
Not entirely sure, but an observation is that it does seem to work when handling "new_connection" and changing the value there instead. So maybe "connection_state_remove" is being raised as a result of reaching the end of the pcap and persistent state tracking/changes doesn't work as well when Bro is in the process of shutting down.
More information about the Bro