[Bro-Dev] New http scripts

[Seth Hall]

On Aug 17, 2011, at 1:21 AM, Gregor Maier wrote:

> quick question. For the new http scripts, after logging a request in 
> http_message_done, should the c$http record be deleted and re-populated? 

Gregor and I talked about this and he wasn't seeing the line of code that does what he wanted. :)

In almost all cases, when you handle http events and you don't supply a priority for the handler, the c$http record should be set correctly even in the face of pipelined requests.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/