[Bro-Dev] #329: Remove detect-protocols-http.bro from Broctl's default local.bro

Bro Tracker bro at tracker.icir.org
Mon Dec 6 07:09:00 PST 2010


#329: Remove detect-protocols-http.bro from Broctl's default local.bro
-------------------------+--------------------
  Reporter:  seth        |      Owner:  robin
      Type:  Task        |     Status:  new
  Priority:  Normal      |  Milestone:  Bro1.6
 Component:  BroControl  |    Version:
Resolution:              |   Keywords:
-------------------------+--------------------

Comment (by seth):

 > (1) Rewrite the for loop to instead use the '''match''' primitive.
 >
 > (2) Provide language support for constructing a merged version of the
 > regular expressions listed in the table, and then first test whether
 > there's a match to the disjunction of them before bothering to loop over
 > to find which particular one matched.


 Great ideas!  I was actually planning on implementing pattern construction
 at init time this week anyway.

 This is generally good though, it will be heading down the path of how
 signatures are implemented internally but in scripting land.

-- 
Ticket URL: <http://tracker.icir.org/bro/ticket/329#comment:1>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker




More information about the bro-dev mailing list