[Bro] how to get the oldest entry out of table

Christoph Goeldi goeldich at ee.ethz.ch
Mon Feb 7 07:28:10 PST 2005


hi everybody


is it possible to get the oldest entry out of a table?

for example, i want to get the earliest occurence of an event from a 
certain source ip. i have saved all occurences in a table like this:

 > global test: table[addr, time] of count &write_expire=10min;

how can i get the oldest entry?

does a for-loop go through the table in a predictable way?


thanx for any help
christoph



More information about the Bro mailing list