[Bro-Dev] notice tags?

Seth Hall seth at icir.org
Fri Jun 3 09:02:33 PDT 2011


On Jun 3, 2011, at 11:35 AM, Gregor Maier wrote:

> Do we still need the tags once we have unique connids for grepping?


It might be worthwhile still.  It was interesting to me to see all of the notices attached to a connection.  I'm a big proponent of browsing Bro logs and I like anything that makes my browsing experience better. :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/




More information about the bro-dev mailing list