[Bro-Dev] active_conns

Robin Sommer robin at icir.org
Fri Mar 18 08:30:05 PDT 2011


On Thu, Mar 17, 2011 at 16:41 -0700, you wrote:

> I like the idea, however, I guess one question would be what the memory
> overhead would be.

Wouldn't be very concerned about that. It's not much per connection
(compared to how much we already store ...), and just by not having
some of the other high volume tables (like http_sessions) we'd
probably compensate for quite a bit alredy.

That said, I'm still not argueing for this. I also like Seth's current
model. 

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org


More information about the bro-dev mailing list