[Bro] how to get the oldest entry out of table
Christoph Goeldi
goeldich at ee.ethz.ch
Mon Feb 7 07:28:10 PST 2005
hi everybody
is it possible to get the oldest entry out of a table?
for example, i want to get the earliest occurence of an event from a
certain source ip. i have saved all occurences in a table like this:
> global test: table[addr, time] of count &write_expire=10min;
how can i get the oldest entry?
does a for-loop go through the table in a predictable way?
thanx for any help
christoph
More information about the Bro
mailing list