> On Sep 21, 2016, at 5:03 PM, Fernandez, Mark I <mfernan...@mitre.org> wrote:
> Design guidance: is it acceptable to redefine/extend the ‘conn_id’ record as
> described above?
You probably don't want to extend the conn_id record. There are some cases
where it can cause trouble doing lookups because the conn_id is used at a table
index in a lot of places.
Is there somewhere else you could stash the information that you need?
International Computer Science Institute
(Bro) because everyone has a network
bro-dev mailing list