[Bro-Dev] Per connection byte and packet counting

Robin Sommer robin at icir.org
Fri Dec 10 03:01:29 PST 2010


On Thu, Dec 09, 2010 at 09:39 -0800, you wrote:

> * 901 MB  ... baseline trunk
> * 903 MB ... baseline w/ optionals. No counting what-so-ever

This looks good enough to me, seems fine adding the fields.  

> I haven't yet tested the "Counting in separate Child Analyzer, reporting
> via connection record's endpoint record".

Conceptually this would be my preferred approach. See my other mail
for thoughts on how to implement it. But it would be interesting to
see memory usage and potential run-time ffects for this case before
deciding.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org


More information about the bro-dev mailing list