[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
Robin Sommer
robin at icir.org
Tue Aug 27 14:10:15 PDT 2013
I like that idea. Storage-wise it's 2x64 bit anyways.
Robin
On Tue, Aug 27, 2013 at 16:04 -0500, you wrote:
> Regarding performance: another option would be to use 128-bit UUIDs
> internally and just chop of 32 bytes if a 96-bit UUID is desired,
> assuming the bits in the UUID are distributed uniformly. Then we could
> use a fixed-size array and just change how the data is interpreted at
> script land.
>
> > Option to extend uids to 128 bit
> > --------------------------------
> >
> > Key: BIT-1016
> > URL: https://bro-tracker.atlassian.net/browse/BIT-1016
> > Project: Bro Issue Tracker
> > Issue Type: New Feature
> > Components: Bro
> > Affects Versions: git/master
> > Reporter: rhave
> > Assignee: Jon Siwek
> > Priority: Low
> > Fix For: 2.2
> >
> >
> > Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table).
> > I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit.
> > I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc
>
>
>
> --
> This message was sent by Atlassian JIRA
> (v6.1-OD-06#6139)
> _______________________________________________
> bro-dev mailing list
> bro-dev at bro.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
>
More information about the bro-dev
mailing list