[Bro-Dev] [Auto] Merge Status
Open Merge Requests === IDComponentReporterAssignee Updated For Version PrioritySummary --- -- - -- - -- BIT-1068 [1] BroControl Seth Hall Daniel Thayer 2013-08-262.2 Normal pin_cpus error message BIT-1016 [2] Bro rhave - 2013-08-262.2 Low Option to extend uids to 128 bit Open GitHub Pull Requests = IssueComponentUser Updated Title --- --- - -- -- #1 [3] broccoli dcode [4] 2013-08-12 Updated specfile. Works under mock for EL6 [5] [1] BIT-1068 https://bro-tracker.atlassian.net/browse/BIT-1068 [2] BIT-1016 https://bro-tracker.atlassian.net/browse/BIT-1016 [3] Pull Request #1 https://github.com/bro/broccoli/issues/1 [4] dcode https://github.com/dcode [5] Merge Pull Request #1 with git pull https://github.com/dcode/broccoli.git master ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1069) merge topic/bernhard/hexstr
Bernhard Amann created BIT-1069: --- Summary: merge topic/bernhard/hexstr Key: BIT-1069 URL: https://bro-tracker.atlassian.net/browse/BIT-1069 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: Bernhard Amann Priority: Low topic/bernhard/hexstr contains a bif function hexstr_to_bytestring which does exactly the opposite of the existing bytestring_to_hexstr -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1069) merge topic/bernhard/hexstr
[ https://bro-tracker.atlassian.net/browse/BIT-1069?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bernhard Amann updated BIT-1069: Status: Merge Request (was: Open) merge topic/bernhard/hexstr --- Key: BIT-1069 URL: https://bro-tracker.atlassian.net/browse/BIT-1069 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: Bernhard Amann Priority: Low topic/bernhard/hexstr contains a bif function hexstr_to_bytestring which does exactly the opposite of the existing bytestring_to_hexstr -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[ https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13805#comment-13805 ] Adam Slagell commented on BIT-1016: --- C-hex probably doesn't matter. They could treat it as part of the hex and it would still be unique. Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[ https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Robin Sommer updated BIT-1016: -- Status: Open (was: Merge Request) Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1068) pin_cpus error message
[ https://bro-tracker.atlassian.net/browse/BIT-1068?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13807#comment-13807 ] Daniel Thayer commented on BIT-1068: Yes, it was intentional. Without that check, then if true is not found (very unlikely), then bro will always fail to start (when CPU pinning is in use). pin_cpus error message -- Key: BIT-1068 URL: https://bro-tracker.atlassian.net/browse/BIT-1068 Project: Bro Issue Tracker Issue Type: Problem Components: BroControl Affects Versions: 2.2 Reporter: Seth Hall Assignee: Daniel Thayer Fix For: 2.2 I seem to be having a problem with the cpu_pin feature of broctl. I'm getting the following output... [rootsh@xx worker-1-6]# cat stderr.log sched_setaffinity: Invalid argument failed to set pid 0's affinity. Daniel, any clue what I should be looking into or information I can provide? -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1068) pin_cpus error message
[
https://bro-tracker.atlassian.net/browse/BIT-1068?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13806#comment-13806
]
Robin Sommer commented on BIT-1068:
---
Is the true here intentional?
{code}
[…]
# message just in case there's some other reason for the failure).
true
if [ $? -eq 0 ]; then
[…]
{code}
pin_cpus error message
--
Key: BIT-1068
URL: https://bro-tracker.atlassian.net/browse/BIT-1068
Project: Bro Issue Tracker
Issue Type: Problem
Components: BroControl
Affects Versions: 2.2
Reporter: Seth Hall
Assignee: Daniel Thayer
Fix For: 2.2
I seem to be having a problem with the cpu_pin feature of broctl. I'm
getting the following output...
[rootsh@xx worker-1-6]# cat stderr.log
sched_setaffinity: Invalid argument
failed to set pid 0's affinity.
Daniel, any clue what I should be looking into or information I can provide?
--
This message was sent by Atlassian JIRA
(v6.1-OD-06#6139)
___
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[ https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13808#comment-13808 ] Robin Sommer commented on BIT-1016: --- Good point. Robin -- Robin Sommer * Phone +1 (510) 722-6541 * ro...@icir.org ICSI/LBNL* Fax +1 (510) 666-2956 * www.icir.org/robin Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
On Tue, Aug 27, 2013 at 20:35 +, you wrote: FWIW, I prefer Chex for the simple reason that if I double-click it, it selects the whole uid (including the C), and I can then copy the whole thing. Good point. Robin -- Robin Sommer * Phone +1 (510) 722-6541 * ro...@icir.org ICSI/LBNL* Fax +1 (510) 666-2956 * www.icir.org/robin ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
On Aug 27, 2013, at 3:50 PM, Robin Sommer (JIRA) j...@bro-tracker.atlassian.net wrote: - We could use C-hex instead of Chex to make it more obvious that the first character is special. But not sure if it's worth it. FWIW, I prefer Chex for the simple reason that if I double-click it, it selects the whole uid (including the C), and I can then copy the whole thing. I also feel like when you actually look at a log, and one column always starts with a C and one starts with an F, it will be obvious enough. /$0.02 --Vlad ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[
https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13809#comment-13809
]
Jon Siwek commented on BIT-1016:
{quote}while I generally like the bits_per_uid option, I'm wondering about the
performance impact. If it were a static number, UID could just use a
correspondingly sized array, vs. now using a relative expensive std::vector. Is
the flexibility worth that here? I think a good alternative would be to just
#define the bit length in UID, then we could at least easily increase it
later.{quote}
We know that there's people (person) that may want something other than our
default and we know that not everyone runs Bro by compiling it from source, so
having the option to change it at parse-time I thought was nice.
{quote}If we want to keep the bits_per_uid option, could we at least switch to
malloced array instead of std::vector with several pushs per UID?{quote}
I preferred vector to start because it's safer/simpler to write correct code,
but yeah I can look in to that optimization especially since there's not a lot
of code involved.
{quote}If keeping bits_per_uid, please add a test case that tries a few
different values for it.{quote}
Ok.
Option to extend uids to 128 bit
Key: BIT-1016
URL: https://bro-tracker.atlassian.net/browse/BIT-1016
Project: Bro Issue Tracker
Issue Type: New Feature
Components: Bro
Affects Versions: git/master
Reporter: rhave
Assignee: Jon Siwek
Priority: Low
Fix For: 2.2
Bro's uids are currently 64 bits, which makes them collide with a 50% chance
after 5.1 x 10^9^ different uids (see
http://en.wikipedia.org/wiki/Birthday_problem#Probability_table).
I'm currently generating uuids of 128 bit to replace the native uids in bro,
as I'm using them as keys in a database, but this requires rewriting of the
bro-logs. I suspect that more people could benefit from an option to extend
the uids to 128 bit.
I've made a quick and dirty patch to change most of the uids to 128 bit
(file_analysis uids are missing). The patch is ugly, and is only to show some
of the functionality I would like: http://pastebin.com/GkaGejNc
--
This message was sent by Atlassian JIRA
(v6.1-OD-06#6139)
___
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[ https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13810#comment-13810 ] Matthias Vallentin commented on BIT-1016: - Regarding performance: another option would be to use 128-bit UUIDs internally and just chop of 32 bytes if a 96-bit UUID is desired, assuming the bits in the UUID are distributed uniformly. Then we could use a fixed-size array and just change how the data is interpreted at script land. Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
I like that idea. Storage-wise it's 2x64 bit anyways. Robin On Tue, Aug 27, 2013 at 16:04 -0500, you wrote: Regarding performance: another option would be to use 128-bit UUIDs internally and just chop of 32 bytes if a 96-bit UUID is desired, assuming the bits in the UUID are distributed uniformly. Then we could use a fixed-size array and just change how the data is interpreted at script land. Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[ https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13811#comment-13811 ] Robin Sommer commented on BIT-1016: --- I like that idea. Storage-wise it's 2x64 bit anyways. Robin Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
[
https://bro-tracker.atlassian.net/browse/BIT-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanelfocusedCommentId=13812#comment-13812
]
Jon Siwek commented on BIT-1016:
{quote}
Regarding performance: another option would be to use 128-bit UUIDs internally
and just chop of 32 bytes if a 96-bit UUID is desired, assuming the bits in the
UUID are distributed uniformly. Then we could use a fixed-size array and just
change how the data is interpreted at script land.
{quote}
This is kind of what currently happens: the UID gets calculated in 64-bit
chunks, then truncated if necessary. Except you can ask for more than 128-bits
if you want.
Option to extend uids to 128 bit
Key: BIT-1016
URL: https://bro-tracker.atlassian.net/browse/BIT-1016
Project: Bro Issue Tracker
Issue Type: New Feature
Components: Bro
Affects Versions: git/master
Reporter: rhave
Assignee: Jon Siwek
Priority: Low
Fix For: 2.2
Bro's uids are currently 64 bits, which makes them collide with a 50% chance
after 5.1 x 10^9^ different uids (see
http://en.wikipedia.org/wiki/Birthday_problem#Probability_table).
I'm currently generating uuids of 128 bit to replace the native uids in bro,
as I'm using them as keys in a database, but this requires rewriting of the
bro-logs. I suspect that more people could benefit from an option to extend
the uids to 128 bit.
I've made a quick and dirty patch to change most of the uids to 128 bit
(file_analysis uids are missing). The patch is ugly, and is only to show some
of the functionality I would like: http://pastebin.com/GkaGejNc
--
This message was sent by Atlassian JIRA
(v6.1-OD-06#6139)
___
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
