[Bro-Dev] Unique connection ID for bro <-> logging framework

[Robin Sommer]

On Mon, Dec 13, 2010 at 11:29 -0800, you wrote:

> I'd prefer to keep the counter and the runID separate. E.g., by making
> the runID n-bits and the counter 64-n bits and the OR-ing them together.

What's the advatnage of keeping them separate?

> using a say, 32 bit runID + 64 bit unique-ID. We now use ACSII for
> logging, if we move to binary (and possibly compression), then this will
> save *way* more memory than our ID will ever add.

Well, that's right, but still no excuse for waste if we don't need
it. :)

(I'm also thingking about potentially piping logs into a DB and
perhaps indexing on such an ID as a key.)

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org