[Bro-Dev] Pktsrc prefix separator (Re: [JIRA] (BIT-1267) packet source prefix separator in node.cfg breaks broctl)

Robin Sommer robin at icir.org
Thu Oct 2 08:45:05 PDT 2014

(Taking this to bro-dev for discussion.)

On Wed, Oct 01, 2014 at 22:31 -0500, Daniel wrote for

> Using a different class (instead of SafeConfigParser) from the
> ConfigParser module seems to fix the problem.

Seems I hit another prefix separator that already had a meaning. :)

SafeConfigParser implements some interpolation features using % as the
control character. I don't think we're using that anywhere, so it
might be fine; on the other hand the docs say:

    Derived class of ConfigParser that implements a more-sane variant
    of the magical interpolation feature. This implementation is more
    predictable as well. New applications should prefer this version
    if they don’t need to be compatible with older versions of

So we can either ignore that, or change the prefix separator once
more. If we did the latter, any idea what would be a good one? As a
reminder, the problem is specifying the packet source plugin to use
with an interface, e.g., currently you'd say "-i netmap%eth1" to
monitor eth1 via the netmap plugin. It used to be "-i netmap:eth1" but
that conflicts with some BPF devices that use the colon already. So,
what would be better than ':' or '%', both visually and in terms of
not conflicting with existing interface naming conventions?


More information about the bro-dev mailing list