[Bro] connection_established for udp
Robin Sommer
robin at icir.org
Fri Apr 19 14:24:37 PDT 2013
On Fri, Apr 19, 2013 at 21:05 +0000, Jonathan Siwek wrote:
> How about also handling "new_connection" and polling that connection
> periodically for a non-zero c$resp$size ? That may be more expensive,
> though.
It would actually be useful to have a "new_udp_connection" (or so)
event that triggers only for new UDP flows. I don't think I'd tie the
bi-directionality in there, but that along with the polling could
work.
Robin
--
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org/robin
More information about the Bro
mailing list