[Bro-Dev] $tag in notice_info

Vern Paxson vern at icir.org
Mon Mar 21 20:12:46 PDT 2011


>  - There are actually a number of hash algorithms in Hash.{h,cc}, with
>  only one of them being used (via #ifdefs). Vern, do you remember the
>  story behind having multiple of them

I'm pretty sure that Ruoming (or maybe even Yin Zhang, come to think of it)
had several so he could do performance testing across them.

> and can we just remove the code for those not enabled?

Yeah, though hopefully we'll remember that we have them buried in
the repository if at some point we find ourselves wanting to play
with hash functions again.

>  - I'm wondering whether for the unique connection ids it would make
>  sense to make them stable in the case that we're working offline from
>  a trace.

I would definitely like that!

		Vern


More information about the bro-dev mailing list