[Bro] A few questions

Seth Hall hall.692 at osu.edu
Wed Feb 3 06:58:02 PST 2010


On Feb 3, 2010, at 9:33 AM, Justin Azoff wrote:

> On Wed, Feb 03, 2010 at 09:25:45AM -0500, Seth Hall wrote:
>>> my_switch :: HashSwitch(26, 8);
>>
>> This doesn't work right.  Your config is based on the change you  
>> made to
>> the hashswitch element in your build isn't it?
>
> No.. we originally had this:
>
> my_switch :: HashSwitch(0, 6);
>
> but that was asuming the ethernet header had already been stripped  
> by another
> element. The 26 skips the ethernet header and then everything works  
> right.


Yeah, the 8 is what I was referring to though.  The two directions of  
traffic could go to different outputs because it would be hashing the  
bytes of both IP addresses and would be two different values for the  
two directions.

   .Seth

---
Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721




More information about the Bro mailing list