[Bro] Determining when the Conn::log_conn event executes
jlay at slave-tothe-box.net
Thu Apr 14 12:33:52 PDT 2016
On 2016-04-14 13:06, Lamps, Jereme wrote:
> Does anyone have an idea of when the Conn::log_conn event executes?
> Does it execute whenever Bro believes the connection is finished, or
> can it execute earlier than that?
> Thanks in advance
> Bro mailing list
> bro at bro-ids.org
My understanding is once the session has completed.
More information about the Bro