[Bro-Dev] Combining HTTP scripts?

Vern Paxson vern at icir.org
Wed Feb 9 10:10:46 PST 2011

> Is there a consensus that that's the right way to go?

In general I like that.  However, where do you draw the line?  Processing
individual headers and/or capturing transferred entities gets expensive.
It's certainly reasonable that a default config gets response processing
along with request processing; but I'm not sure about what other stuff it
should include, due to load / log space considerations.


More information about the bro-dev mailing list