[Bro-Dev] Broker::publish API

Jon Siwek jsiwek at corelight.com
Mon Jul 30 11:30:30 PDT 2018


On Mon, Jul 30, 2018 at 12:16 PM Robin Sommer <robin at corelight.com> wrote:

> > I'd be more comfortable if one could automate answering the question:
> > "if I add a subscription to a given node in the network, will I create
> > a cycle?".
>
> Hmm ... What about a test mode where we'd spin up a dummy cluster
> (similar to what the bests do), have each node send a message to all
> subscribed topics, and watch for TTL violations?

Seems clunky and could get dicey -- subscriptions that
transient/dynamic may not be well-tested and you'd probably want to
guarantee that sending such a dummy message actually does not result
in any side-effects at the Bro-layer.  If nodes start raising random
events at unusual/unintended times I start to doubt the stability of
things.

- Jon


More information about the bro-dev mailing list