[Bro] How to check the length of NDS request packets?

Azoff, Justin S jazoff at illinois.edu
Thu Jun 8 13:17:29 PDT 2017


> On Jun 8, 2017, at 4:02 PM, Hongda Li <hongdal at g.clemson.edu> wrote:
> 
> The problem is the "dns_request" event does not provide packet length, which means, for every DNS request, I have to check the requested domain name. This is expensive. 

Why do you say that it is expensive?  Getting the length of a string in bro is an O(1) operation.

-- 
- Justin Azoff




More information about the Bro mailing list