[Bro-Dev] Proposed IOSource reorg

Seth Hall seth at icir.org
Wed Dec 11 11:23:12 PST 2013

On Dec 11, 2013, at 1:48 PM, Robin Sommer <robin at icir.org> wrote:

> As I'm working on the reorg, I propose to do the following:

Everything sound good to me.

>      large-conns.bro seems to be the only actual use case, which we
>      don't ship with 2.x anymore, and I'm not convinced that by
>      itself warrants a separate data path (can we find a different
>      solution to the problem?)

I think the only reason that large-conns.bro used the secondary data path was to get access to more traffic that Bro might not be normally seeing due to being filtered out.  With our change to a default open filter (and I don't see this changing anytime soon) we don't need the secondary path to let in more traffic than is normally allowed in.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20131211/e12d140a/attachment.bin 

More information about the bro-dev mailing list