[Bro-Dev] more set operators? (equality/subset)

Vern Paxson vern at corelight.com
Fri Jun 29 09:55:19 PDT 2018

> Oh, neat. If that actually works in all cases (so also with records of
> records, etc)

Well, it almost does.  I tried it with records that contain records and
that's fine.  For records that contain sets, it often works in my testing,
but not always, evidently due to the randomized hash keying, since I can
make it go away by always loading the same seeds.

The same problem occurs with set deletion: deleting from a set of
records-containing-sets sometimes fails to delete an element that's
indeed in the set.  (Hmmm and we also don't support sets of sets, which
seems like a natural.)

I think the right answer for this is to have some sort of canonical ordering
for hash keys.  Seems like a pain given the need to also randomize hash
keys.  I'll file a ticket, but won't aim to fix it this go-around.


More information about the bro-dev mailing list