>> A side note: I suspect that the table syncing did and still does not >> work as reliable as one would expect. But according to Johanna this will >> become deprecated soon, so I did not touch that code. > > If there's any obvious problem, we should still take a look, but more > generally: yeah Broker will take that over as soon as things are in > sufficient shape.
The thing is I don't get why reads only need to be propagated once per (half) &read_expire interval (see https://github.com/bro/bro/blob/master/src/Val.cc#L2326). If there was a read at the beginning of the (half) interval and another one close to the end, a peer might expire a value too early based on the first read. Seems someone put some thought into this so maybe I miss something here :) Best regards, Jan _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
