> I'd wait for two more things though: Aashish also raised some potential bugs with Bro's hashing. It appears that the Bloom filters fill up too quickly, i.e., do not meet their false positive requirements. My hunch is that this has to do with the construction of hash functions, perhaps they are not pairwise independent unless parametrized in a certain way, or perhaps there's just some other smaller bug in place. In any case, it needs to be fixed and I wonder whether 2.2.1 is the right target for that.
Matthias _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev