[Bro-Dev] Proposed IOSource reorg
seth at icir.org
Wed Dec 11 11:23:12 PST 2013
On Dec 11, 2013, at 1:48 PM, Robin Sommer <robin at icir.org> wrote:
> As I'm working on the reorg, I propose to do the following:
Everything sound good to me.
> large-conns.bro seems to be the only actual use case, which we
> don't ship with 2.x anymore, and I'm not convinced that by
> itself warrants a separate data path (can we find a different
> solution to the problem?)
I think the only reason that large-conns.bro used the secondary data path was to get access to more traffic that Bro might not be normally seeing due to being filtered out. With our change to a default open filter (and I don't see this changing anytime soon) we don't need the secondary path to let in more traffic than is normally allowed in.
International Computer Science Institute
(Bro) because everyone has a network
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20131211/e12d140a/attachment.bin
More information about the bro-dev