[Bro] Filtering PacketFilter::Dropped_Packets
Martin Holste
mcholste at gmail.com
Tue Apr 17 10:53:20 PDT 2012
Nope, not doing that.
On Tue, Apr 17, 2012 at 11:19 AM, Seth Hall <seth at icir.org> wrote:
>
> On Apr 17, 2012, at 9:41 AM, Martin Holste wrote:
>
>> Looks like Will's method is working. Thanks much!
>
>
> Everything implemented internally should make this work. There is one thing I'm wondering though. In any of your scripts you're running locally, are you doing…
>
> redef Notice::policy = { … };
>
> Instead of…
>
> redef Notice::policy += { … };
>
> It's a small difference, but causes a big change because those shortcuts (like ignored_types) are basically just pre-implemented notice policy items which you are blowing away if you do full set assignment instead of adding items to the set. I'll start trying to think of way to make that more resilient to this too. This fragility is the one thing I don't like about those pre-implemented policy items.
>
> .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro-ids.org/
>
More information about the Bro
mailing list