[Bro] timely question about tables

[Robin Sommer]

On Wed, Feb 07, 2007 at 15:26 -0600, Mike Dopheide wrote:

> For table attributes such as &create_expire and &write_expire, is 
> elapsed time based on real time or network time?

It's network time but note that the timeouts actually give *minimum*
intervals before elements are expired; elements may be kept longer
than the interval specifies, especially for large tables. 

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org