[Bro-Dev] trace-summary question

[Seth Hall]

On Aug 8, 2011, at 11:20 AM, Robin Sommer wrote:

> On Mon, Aug 08, 2011 at 10:33 -0400, you wrote:
> 
>> My plan was to enable Gregor's ConnSize analyzer by default.  Does it make sense to use the values acquired from that in place of the existing values?
> 
> We should offer both, they have different sematnics. However we could
> include only the ConnSize one in base (as that's probably what people
> intuively expect) and offer the current one as an option to add
> additionally?


I think that sounds optimal.  We even have the perfect place to put the script that adds that information now (after the latest reorg). :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/