[Bro] rexmit_inconsistency?

Vern Paxson vern at icir.org
Tue Jul 8 14:00:55 PDT 2014


> if it has been ACK'd, I don't expect the reassembler to keep that data around

Indeed, it has to release the data upon ACK in order to not wind up buffering
entire byte streams.

		Vern



More information about the Bro mailing list