[Bro] connection_status_update for inactive flows

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon Feb 4 13:12:46 PST 2013


> With a bit of modification, I think so. Would the connection object be
> updated with new data (duration, sizes, etc.) each time
> MyModule::regular_check is called?


I don't think they are necessarily.  E.g. if no other events are raised internally for the connection between the time the event is scheduled and the time when the event handler body actually executes, the connection record fields may not be updated.

One way to guarantee/force updated values is to check if the connection is still around with `connection_exists(c$id)` and then call `lookup_connection(c$id)` if it is.  `ConnPolling::watch()` automates that.

    Jon



More information about the Bro mailing list