[Bro-Dev] Bro byte and packet counting in devel

Seth Hall seth at icir.org
Tue Mar 8 08:11:15 PST 2011

On Mar 8, 2011, at 3:30 AM, Vern Paxson wrote:

> I'm confused.  Are you referring to [or]{lower,upper}?  I'm not recalling
> [or]size ...

[or]size is in the endpoint record.  I think you may be thinking of the large-conns.bro script that calculates an upper and lower bound for the connection size.


More information about the bro-dev mailing list