[Bro-Dev] $tag in notice_info

Seth Hall seth at icir.org
Tue Mar 8 06:04:01 PST 2011


On Mar 8, 2011, at 3:33 AM, Vern Paxson wrote:

> That said, having a more general connection identifier, as subsequently
> discussed, would work for this, too.


That's what I was going to aim for.  Centralizing on a connection identifier makes it possible to remove some other code.  There is a sort-of-tag notion in ftp.bro which I'm removing now that goes the other direction by identifying an FTP session.

  .Seth




More information about the bro-dev mailing list