[Bro] Bro state implementation

[surya]

>No, it's not buffering packets, it just stops processing them (i.e.,
>the kernel will drop packets once its internal buffers are
>exhausted).

Once its resumed will the buffered packets processed by Bro ?.
In our case we doesn't want this.
Is it possible to stop capturing the packets at libpcap level and
later resume capturing the packets with out libpcap initialization.

Thanks,
Surya
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20080403/d72e4ce9/attachment.html