[Bro-Dev] $tag in notice_info
seth at icir.org
Tue Mar 8 06:04:01 PST 2011
On Mar 8, 2011, at 3:33 AM, Vern Paxson wrote:
> That said, having a more general connection identifier, as subsequently
> discussed, would work for this, too.
That's what I was going to aim for. Centralizing on a connection identifier makes it possible to remove some other code. There is a sort-of-tag notion in ftp.bro which I'm removing now that goes the other direction by identifying an FTP session.
More information about the bro-dev