[Bro-Dev] $tag in notice_info

Robin Sommer robin at icir.org
Tue Mar 15 21:22:45 PDT 2011

On Wed, Mar 09, 2011 at 21:57 -0800, you wrote:

> I think a universal hash should work here.  There's already one in Hash.cc,
> thanks to Ruoming (I think) and avoiding algorithmic complexity attacks.

I've added code implementing the unique connection identifiers in a
topic branch.  However, two questions:

 - There are actually a number of hash algorithms in Hash.{h,cc}, with
 only one of them being used (via #ifdefs). Vern, do you remember the
 story behind having multiple of them, and can we just remove the code
 for those not enabled?

 - I'm wondering whether for the unique connection ids it would make
 sense to make them stable in the case that we're working offline from
 a trace. It kind of bothers me that when reading the same trace
 multiple times, I get a different output each time. Should we just
 fix the instance ID when reading from a trace?


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the bro-dev mailing list