[Bro] size file

[Johanna Amann]

Hi Rober,

I think sadly the answer in this case is that this will require
modifications to the Bro core. As far as I can see, set_contents_file is
an irreversible operation (if Bro started extracting the content of a
connection you cannot stop it anymore).

Johanna

On Fri, Nov 03, 2017 at 01:19:28PM +0100, Rober Fernández wrote:
> hi,
> 
> I have this code:
> 
> event connection_established(c: connection)  {
> 
>     local orig_file = generate_extraction_filename(extrac_prefix, c,
> "orig.dat");
>     local orig_f = open(orig_file);
>     set_contents_file(c$id, CONTENTS_ORIG, orig_f);
> 
>     local resp_file = generate_extraction_filename(extrac_prefix, c,
> "resp.dat");
>     local resp_f = open(resp_file);
>     set_contents_file(c$id, CONTENTS_RESP, resp_f);
> 
> }
> 
> and I would like set a maximum size, I think that I have two options,
> 1. set a maximum size file
> 2. control the data so that it does not exceed the size
> 
> How can I do this?
> 
> thanks

> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro