On Dec 11, 2013, at 1:48 PM, Robin Sommer <[email protected]> wrote: > As I'm working on the reorg, I propose to do the following:
Everything sound good to me. > large-conns.bro seems to be the only actual use case, which we > don't ship with 2.x anymore, and I'm not convinced that by > itself warrants a separate data path (can we find a different > solution to the problem?) I think the only reason that large-conns.bro used the secondary data path was to get access to more traffic that Bro might not be normally seeing due to being filtered out. With our change to a default open filter (and I don't see this changing anytime soon) we don't need the secondary path to let in more traffic than is normally allowed in. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
