[Bro-Dev] Bro byte and packet counting in devel

Gregor Maier gregor at icir.org
Tue Mar 8 07:57:28 PST 2011


On 3/8/11 0:30 , Vern Paxson wrote:
>> You might also want to consider that osize and rsize try to count the
>> logical number of payload bytes whereas my analyzer counts the number of
> 
> I'm confused.  Are you referring to [or]{lower,upper}?  I'm not recalling
> [or]size ...

I'm confused. I was referring the connection size as reported in
conn.log (the size that's tracked in the endpoint record of a connection).

hth
Gregor

-- 
Gregor Maier
<gregor at icir.org>  <gregor at icsi.berkeley.edu>
Int. Computer Science Institute (ICSI)
1947 Center St., Ste. 600
Berkeley, CA 94704, USA
http://www.icir.org/gregor/


More information about the bro-dev mailing list