[Bro-Dev] patterns and &&/|| vs. &/| operators

2018-06-19 Thread Vern Paxson
In working on adding bitwise &/| operators for counts, I've come across apparently undocumented && and || operators for patterns: p1 && p2 yields a pattern that matches a p1 followed by a p2 p1 || p2 yields a pattern that matches either p1 or p2 Confusingly, Bro also supports "p1

Re: [Bro-Dev] DHCP event removal

2018-06-19 Thread Seth Hall
On 18 Jun 2018, at 15:09, Alan Commike wrote: > With the default TSV, any change can break export into the various > back-end log stores and SIEMs. When adding new fields, it would be > nice to see them added to the end of the Info structure.  This was a complete rework on the logs and