On Sep 12, 2014, at 9:44 AM, Siwek, Jon <[email protected]> wrote:
> Yes, I think that may be the case, but just for the content_gap event, not > for telling analyzers there’s a gap in the stream. It’s adjustable by > redef'ing BifConst::report_gaps_for_partial. It’s also not new behavior, > that comment was attached to some already-existing code that I factored out > in to a separate function so I could easily re-use it. Not giving judgement > on what behavior should be the default, but changing it shouldn’t be done as > part of what I was trying to fix in this commit. Ah! I remember this now. Thanks for explaining. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/ _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
