[Bro] connection_status_update for inactive flows

David Mandelberg dmandelb at bbn.com
Mon Feb 4 12:46:31 PST 2013


On Mon, 2013-02-04 at 15:03 -0500, Seth Hall wrote:
> I would approach the problem differently, I *really* don't like the connection_status_update event because of the global change as you've noticed.  Are you familiar with scheduled events?  
> 
> You could implement your script like this…
[..]
> Does that work for what you're trying to do?

With a bit of modification, I think so. Would the connection object be
updated with new data (duration, sizes, etc.) each time
MyModule::regular_check is called?





More information about the Bro mailing list