[Bro] rescan_state()?
Mike Sconzo
sconzo at visiblerisk.com
Fri Sep 13 06:58:08 PDT 2013
I've been trying to play with persistent variables with the following:
module PTEST;
global a = 4 &persistent;
event bro_init()
{
if ( rescan_state() )
print "Success!";
print a;
}
event bro_done()
{
if ( checkpoint_state() )
print "Success!";
}
event connection_state_remove(c: connection)
{
a = 5;
}
but the "print a" always prints "4" (regardless of how many times I run
it), what am I missing? Any thoughts?
Bro is being run with bro -C -r test.pcap persistent.bro (from the same
directory each time, and I can see the .state/state.bst file being created.
Thanks.
--
cat ~/.bash_history > documentation.txt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130913/b9f5c123/attachment.html
More information about the Bro
mailing list