[Bro-Dev] Call for opinions on logging framework syntax problem
robin at icir.org
Wed Nov 30 08:31:03 PST 2011
On Tue, Nov 29, 2011 at 23:19 -0500, you wrote:
> If we started using counts for port values (and get rid of the port
> type?) and add a $proto field to conn_id does that break any existing
> assumptions within the language?
Vern might know whether there's anything that would severely break but
my guess is that in principle we could do that. However, I like the
port type, it provides additional context for type checking and
understanding a script. Also, changing that would be quite a large
internal change: the type is used at many places and at some, we'd be
now be left without port information where we need it.
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the bro-dev