[Bro-Dev] New http scripts

Seth Hall seth at icir.org
Thu Aug 18 13:32:29 PDT 2011

On Aug 17, 2011, at 1:21 AM, Gregor Maier wrote:

> quick question. For the new http scripts, after logging a request in 
> http_message_done, should the c$http record be deleted and re-populated? 

Gregor and I talked about this and he wasn't seeing the line of code that does what he wanted. :)

In almost all cases, when you handle http events and you don't supply a priority for the handler, the c$http record should be set correctly even in the face of pipelined requests.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the bro-dev mailing list