[Bro-Dev] Connection Compressor

Seth Hall seth at icir.org
Mon Aug 15 10:29:19 PDT 2011


On Aug 15, 2011, at 1:09 PM, Jim Mellander wrote:

> We like setting record_state_history=T to record the flags that were seen during the connection, and found that the connection compressor didn't play nicely with that, in some cases.

Sounds like more evidence for removing the conn compressor if possible.  Also, state history is included in the new conn logs by default.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/




More information about the bro-dev mailing list