[Bro-Dev] #597: net_init and bro_init

Bro Tracker bro at tracker.bro-ids.org
Wed Sep 7 16:28:56 PDT 2011


#597: net_init and bro_init
----------------------+--------------------
  Reporter:  seth     |      Owner:
      Type:  Problem  |     Status:  new
  Priority:  Normal   |  Milestone:  Bro1.6
 Component:  Bro      |    Version:
Resolution:           |   Keywords:
----------------------+--------------------

Comment (by gregor):

 >  >   I'm currently testing on live traffic with moving the net_init
 function
 >  >   call down to after the bro_init handlers are done.
 >
 >  I can't say immediately whether there are things that depend on order,
 >  but if your testing is going fine, moving should indeed not be a
 >  problem.
 >

 One potential problem might be writing pcap files, since you need to have
 the pcap handle from your capture to know the linktype for the savefile.
 However, I don't know whether that's done in bro_init() or not.

 cu
 gregor

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/597#comment:1>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list