Re: [Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
On Tue, Aug 27, 2013 at 20:35 +, you wrote: FWIW, I prefer Chex for the simple reason that if I double-click it, it selects the whole uid (including the C), and I can then copy the whole thing. Good point. Robin -- Robin Sommer * Phone +1 (510) 722-6541 * ro...@icir.org ICSI/LBNL* Fax +1 (510) 666-2956 * www.icir.org/robin ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
On Aug 27, 2013, at 3:50 PM, Robin Sommer (JIRA) j...@bro-tracker.atlassian.net wrote: - We could use C-hex instead of Chex to make it more obvious that the first character is special. But not sure if it's worth it. FWIW, I prefer Chex for the simple reason that if I double-click it, it selects the whole uid (including the C), and I can then copy the whole thing. I also feel like when you actually look at a log, and one column always starts with a C and one starts with an F, it will be obvious enough. /$0.02 --Vlad ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] [JIRA] (BIT-1016) Option to extend uids to 128 bit
I like that idea. Storage-wise it's 2x64 bit anyways. Robin On Tue, Aug 27, 2013 at 16:04 -0500, you wrote: Regarding performance: another option would be to use 128-bit UUIDs internally and just chop of 32 bytes if a 96-bit UUID is desired, assuming the bits in the UUID are distributed uniformly. Then we could use a fixed-size array and just change how the data is interpreted at script land. Option to extend uids to 128 bit Key: BIT-1016 URL: https://bro-tracker.atlassian.net/browse/BIT-1016 Project: Bro Issue Tracker Issue Type: New Feature Components: Bro Affects Versions: git/master Reporter: rhave Assignee: Jon Siwek Priority: Low Fix For: 2.2 Bro's uids are currently 64 bits, which makes them collide with a 50% chance after 5.1 x 10^9^ different uids (see http://en.wikipedia.org/wiki/Birthday_problem#Probability_table). I'm currently generating uuids of 128 bit to replace the native uids in bro, as I'm using them as keys in a database, but this requires rewriting of the bro-logs. I suspect that more people could benefit from an option to extend the uids to 128 bit. I've made a quick and dirty patch to change most of the uids to 128 bit (file_analysis uids are missing). The patch is ugly, and is only to show some of the functionality I would like: http://pastebin.com/GkaGejNc -- This message was sent by Atlassian JIRA (v6.1-OD-06#6139) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
