[Bro] How to get anything into c$service

Christian Kreibich christian at whoop.org
Fri Sep 21 18:52:18 PDT 2007


Hi,

I seem to have lost the mojo for getting any services to show up in the
connection records' service set. I have:

  @load conn
  redef dpd_conn_logs = T;

However, the service set remains empty in new_connection and
connection_finished events. I guess that makes sense for the former
event, but not the latter, so what else do I need?

(Basically, I'd like to have a reliable way to generate content in
c$service for the broconn Broccoli test case.)

Cheers,
Christian
-- 
________________________________________________________________________
                                           http://www.icir.org/christian
                                                    http://www.whoop.org




More information about the Bro mailing list