[Bro-Dev] #329: Remove detect-protocols-http.bro from Broctl's default local.bro
Bro Tracker
bro at tracker.icir.org
Mon Dec 6 07:09:00 PST 2010
#329: Remove detect-protocols-http.bro from Broctl's default local.bro
-------------------------+--------------------
Reporter: seth | Owner: robin
Type: Task | Status: new
Priority: Normal | Milestone: Bro1.6
Component: BroControl | Version:
Resolution: | Keywords:
-------------------------+--------------------
Comment (by seth):
> (1) Rewrite the for loop to instead use the '''match''' primitive.
>
> (2) Provide language support for constructing a merged version of the
> regular expressions listed in the table, and then first test whether
> there's a match to the disjunction of them before bothering to loop over
> to find which particular one matched.
Great ideas! I was actually planning on implementing pattern construction
at init time this week anyway.
This is generally good though, it will be heading down the path of how
signatures are implemented internally but in scripting land.
--
Ticket URL: <http://tracker.icir.org/bro/ticket/329#comment:1>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list