[Bro-Dev] Broker::publish API
Jon Siwek
jsiwek at corelight.com
Mon Jul 30 11:30:30 PDT 2018
On Mon, Jul 30, 2018 at 12:16 PM Robin Sommer <robin at corelight.com> wrote:
> > I'd be more comfortable if one could automate answering the question:
> > "if I add a subscription to a given node in the network, will I create
> > a cycle?".
>
> Hmm ... What about a test mode where we'd spin up a dummy cluster
> (similar to what the bests do), have each node send a message to all
> subscribed topics, and watch for TTL violations?
Seems clunky and could get dicey -- subscriptions that
transient/dynamic may not be well-tested and you'd probably want to
guarantee that sending such a dummy message actually does not result
in any side-effects at the Bro-layer. If nodes start raising random
events at unusual/unintended times I start to doubt the stability of
things.
- Jon
More information about the bro-dev
mailing list