[Bro] Determining when the Conn::log_conn event executes

James Lay jlay at slave-tothe-box.net
Thu Apr 14 12:33:52 PDT 2016


On 2016-04-14 13:06, Lamps, Jereme wrote:
> Does anyone have an idea of when the Conn::log_conn event executes?
> Does it execute whenever Bro believes the connection is finished, or
> can it execute earlier than that?
> 
> Thanks in advance
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

My understanding is once the session has completed.

James


More information about the Bro mailing list