[Bro-Dev] Combining HTTP scripts?
vern at icir.org
Wed Feb 9 10:10:46 PST 2011
> Is there a consensus that that's the right way to go?
In general I like that. However, where do you draw the line? Processing
individual headers and/or capturing transferred entities gets expensive.
It's certainly reasonable that a default config gets response processing
along with request processing; but I'm not sure about what other stuff it
should include, due to load / log space considerations.
More information about the bro-dev