[Bro] rescan_state()?

Siwek, Jonathan Luke jsiwek at illinois.edu
Fri Sep 13 10:48:30 PDT 2013


> but the "print a" always prints "4" (regardless of how many times I run it), what am I missing? Any thoughts?

Not entirely sure, but an observation is that it does seem to work when handling "new_connection" and changing the value there instead.  So maybe "connection_state_remove" is being raised as a result of reaching the end of the pcap and persistent state tracking/changes doesn't work as well when Bro is in the process of shutting down.

- Jon



More information about the Bro mailing list