[Bro-Dev] Dot release?

Matthias Vallentin vallentin at icir.org
Thu Jan 30 11:22:01 PST 2014


> I'd wait for two more things though:

Aashish also raised some potential bugs with Bro's hashing. It appears
that the Bloom filters fill up too quickly, i.e., do not meet their
false positive requirements. My hunch is that this has to do with the
construction of hash functions, perhaps they are not pairwise
independent unless parametrized in a certain way, or perhaps there's
just some other smaller bug in place. In any case, it needs to be
fixed and I wonder whether 2.2.1 is the right target for that.

    Matthias


More information about the bro-dev mailing list