[Bro] &expire_func/&create_expire question

[Christian Kreibich]

We have some progress on the non-triggering of the expiration callback.
It is triggered, but a *long* time after the &create_expire interval.
Below are the timings using a 20 minute trace for this code:

function expire(t: table[count] of count, idx:count): interval
{
        print fmt("%s %s (expire)", current_time(), network_time());
        return 0 sec;
}

global state: table[count] of count &create_expire=1sec &expire_func=expire;
global idx: count = 0;

event new_packet(c: connection, p: pkt_hdr)
{
        ++idx;
        state[idx] = idx;
        print fmt("%s %s", current_time(), network_time());
}

                          |   current_time()     network_time()
--------------------------+-------------------+-----------------
first packet processed    |  1163809190.13672   1039099587.68955
first expire cb triggered |  1163809190.75784   1039099678.4143

Real time is out, since 1s hasn't yet passed. But network time has
advanced 91s before I see the callback!? 

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org