> On Sep 21, 2016, at 5:03 PM, Fernandez, Mark I <mfernan...@mitre.org> wrote:
> Design guidance: is it acceptable to redefine/extend the ‘conn_id’ record as 
> described above?

You probably don't want to extend the conn_id record.  There are some cases 
where it can cause trouble doing lookups because the conn_id is used at a table 
index in a lot of places.

Is there somewhere else you could stash the information that you need?


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

bro-dev mailing list

Reply via email to