[Bro] Determining when the Conn::log_conn event executes

[Lamps, Jereme]

Does anyone have an idea of when the Conn::log_conn event executes? Does it execute whenever Bro believes the connection is finished, or can it execute earlier than that?

Thanks in advance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160414/6be6f552/attachment.html