[Bro] connection_status_update for inactive flows
David Mandelberg
dmandelb at bbn.com
Mon Feb 4 12:46:31 PST 2013
On Mon, 2013-02-04 at 15:03 -0500, Seth Hall wrote:
> I would approach the problem differently, I *really* don't like the connection_status_update event because of the global change as you've noticed. Are you familiar with scheduled events?
>
> You could implement your script like this…
[..]
> Does that work for what you're trying to do?
With a bit of modification, I think so. Would the connection object be
updated with new data (duration, sizes, etc.) each time
MyModule::regular_check is called?
More information about the Bro
mailing list