[Bro] Bro: TCP reassembly question

[Adayadil Thomas]

Greetings.

I have a couple of questions about BRO's tcp stream reassembly. Please reply
if you have answers.

When does bro allocate memory for doing reassembly (putting the different
blocks of data together) ?
Does it append to this same buffer when subsequent stream data comes ?
What is the size of the reassembly buffer ? Does that grow ? till what size
does it grow ?


Any information or pointers is appreciated.

Thanks a lot
Thomas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20060126/08f87ee7/attachment.html