[Bro-Dev] trace-summary question

Vern Paxson vern at icir.org
Sun Aug 7 22:01:23 PDT 2011

> (Unfortunately, wrap around is more likely to occur for larger
> connections, and by excluding those we may miss actually a signficiant
> chunk for the summary. But there's not much to do about that with a
> given summary; garbage in, garbage out. :-)

(Well, there used to be something to do - use large-conns.bro, until it
was unceremoniously dumped)

More information about the bro-dev mailing list