[Bro] How to check the length of NDS request packets?
Azoff, Justin S
jazoff at illinois.edu
Thu Jun 8 13:17:29 PDT 2017
> On Jun 8, 2017, at 4:02 PM, Hongda Li <hongdal at g.clemson.edu> wrote:
>
> The problem is the "dns_request" event does not provide packet length, which means, for every DNS request, I have to check the requested domain name. This is expensive.
Why do you say that it is expensive? Getting the length of a string in bro is an O(1) operation.
--
- Justin Azoff
More information about the Bro
mailing list