[Bro-Dev] Call for opinions on logging framework syntax problem

Vern Paxson vern at icir.org
Thu Dec 1 12:15:44 PST 2011


> > If we started using counts for port values (and get rid of the port
> > type?) and add a $proto field to conn_id does that break any existing
> > assumptions within the language?
> 
> Vern might know whether there's anything that would severely break but
> my guess is that in principle we could do that.

I suspect it would be a mess.  But, more fundamentally, I really resist
getting rid of ports as a built-in type.

		Vern


More information about the bro-dev mailing list