> On Sep 21, 2016, at 5:03 PM, Fernandez, Mark I <mfernan...@mitre.org> wrote:
> 
> Design guidance: is it acceptable to redefine/extend the ‘conn_id’ record as 
> described above?

You probably don't want to extend the conn_id record.  There are some cases 
where it can cause trouble doing lookups because the conn_id is used at a table 
index in a lot of places.

Is there somewhere else you could stash the information that you need?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/


_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev

Reply via email to