[Bro] connection_established for udp

Robin Sommer robin at icir.org
Fri Apr 19 14:24:37 PDT 2013



On Fri, Apr 19, 2013 at 21:05 +0000, Jonathan Siwek wrote:

> How about also handling "new_connection" and polling that connection
> periodically for a non-zero c$resp$size ?  That may be more expensive,
> though.

It would actually be useful to have a "new_udp_connection" (or so)
event that triggers only for new UDP flows. I don't think I'd tie the
bi-directionality in there, but that along with the polling could
work.

Robin


-- 
Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin



More information about the Bro mailing list