[Bro-Dev] Proposed IOSource reorg

[Seth Hall]

On Dec 11, 2013, at 1:48 PM, Robin Sommer <robin at icir.org> wrote:

> As I'm working on the reorg, I propose to do the following:

Everything sound good to me.

>      large-conns.bro seems to be the only actual use case, which we
>      don't ship with 2.x anymore, and I'm not convinced that by
>      itself warrants a separate data path (can we find a different
>      solution to the problem?)

I think the only reason that large-conns.bro used the secondary data path was to get access to more traffic that Bro might not be normally seeing due to being filtered out.  With our change to a default open filter (and I don't see this changing anytime soon) we don't need the secondary path to let in more traffic than is normally allowed in.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20131211/e12d140a/attachment.bin