[Bro] A few questions

[Justin Azoff]

On Wed, Feb 03, 2010 at 09:25:45AM -0500, Seth Hall wrote:
>> my_switch :: HashSwitch(26, 8);
>
> This doesn't work right.  Your config is based on the change you made to 
> the hashswitch element in your build isn't it?

No.. we originally had this:

my_switch :: HashSwitch(0, 6);

but that was asuming the ethernet header had already been stripped by another
element. The 26 skips the ethernet header and then everything works right.

I've been running with that config for over a month now and as far as I can
tell it is working properly :-)


-- 
-- Justin Azoff
-- Security & Network Performance Analyst