[Bro-Dev] Per connection byte and packet counting
Robin Sommer
robin at icir.org
Fri Dec 10 03:01:29 PST 2010
On Thu, Dec 09, 2010 at 09:39 -0800, you wrote:
> * 901 MB ... baseline trunk
> * 903 MB ... baseline w/ optionals. No counting what-so-ever
This looks good enough to me, seems fine adding the fields.
> I haven't yet tested the "Counting in separate Child Analyzer, reporting
> via connection record's endpoint record".
Conceptually this would be my preferred approach. See my other mail
for thoughts on how to implement it. But it would be interesting to
see memory usage and potential run-time ffects for this case before
deciding.
Robin
--
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the bro-dev
mailing list