[Bro-Dev] $history extensions - zero windows, logarithmic counts

Vern Paxson vern at corelight.com
Fri Jun 15 11:51:00 PDT 2018


> Here we will not have cases where some repetitions are logarithmic, and
> some (like for R) are not. I guess that makes sense, but I can see it
> potentially being confusing.

Yeah, I chewed on that too, but I don't see a better solution.  The semantics
of repeated R are different, too (per the recent $history thread, it entails
differing sequence numbers), so I think once that's the case, then it's
not all that much more confusing if the significance of a repetition has
different semantics too.

		Vern


More information about the bro-dev mailing list