[Bro-Dev] [Bro-Commits] [git/bro] topic/bernhard/file-analysis-x509: Change x509 log - now certificates are only logged once per hour. (0d50b8b)
Seth Hall
seth at icir.org
Thu Mar 13 07:37:05 PDT 2014
On Mar 13, 2014, at 10:30 AM, Robin Sommer <robin at icir.org> wrote:
> On Thu, Mar 13, 2014 at 00:17 -0700, Bernhard Amann wrote:
>
>> You apparently have to be very careful which EndOfFile function of
>> the file analysis framework you call... otherwhise it might try
>> to close another file id. This took me quite a while to find.
>
> Can you elaborate? I sense an opportuntity to improve our API. :-)
I think he was running into the interplay between script land and the core. Actually, I think that for the SSL/TLS analyzer, this is one of the times we don't need a file id generated in script land. That's probably a better choice in this case.
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20140313/c66d3ae1/attachment.bin
More information about the bro-dev
mailing list