[Bro] question about event http_stats

[Sen Yang]

Thanks Vern.
I mean in the $brohome /share/bro/ folder, the http.bro file. It have
an event handler for the http_stats event. But made invalid using "#".
 I thought it was because stats$num_requests is 0. But get over it.
Thanks

Sen





On Sun, May 2, 2010 at 4:43 AM, Vern Paxson <vern at icir.org> wrote:
>> #global http_stats: event(c: connection, stats: http_stats_rec);
>>
>> the http_stats event, I think it is raised when one http session is
>> done? But why
>> the stats$num_requests can be 0?
>
> I would expect (and looking briefly at the code this appears to be true)
> that an http_stats event is generated whenever an HTTP connection finishes,
> even if nothing happened during the connection (no GET request, just a
> SYN handshake).  If so, then it would make sense that such unproductive
> sessions have $num_requests equal to 0.
>
>> I noticed in the http.bro, there is one handler for this event but
>> then annotated.
>
> I'm not following this comment ...
>
>                Vern
>