[Bro-Dev] Configurable &write_expire interval

Jan Grashöfer jan.grashoefer at gmail.com
Mon Jun 13 17:35:40 PDT 2016


>> A side note: I suspect that the table syncing did and still does not
>> work as reliable as one would expect. But according to Johanna this will
>> become deprecated soon, so I did not touch that code.
> 
> If there's any obvious problem, we should still take a look, but more
> generally: yeah Broker will take that over as soon as things are in
> sufficient shape.

The thing is I don't get why reads only need to be propagated once per
(half) &read_expire interval (see
https://github.com/bro/bro/blob/master/src/Val.cc#L2326). If there was a
read at the beginning of the (half) interval and another one close to
the end, a peer might expire a value too early based on the first read.
Seems someone put some thought into this so maybe I miss something here :)

Best regards,
Jan


More information about the bro-dev mailing list