# 2.5 Roadmap

**URL:** <https://community.zeek.org/t/2-5-roadmap/4144>\
**Category:** Development\
**Tags:** development\
**Created:** [May 7, 2016, 12:56am UTC](https://community.zeek.org/t/2-5-roadmap/4144 "2016-05-07T00:56:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [May 7, 2016, 12:56am UTC](https://community.zeek.org/t/2-5-roadmap/4144/1 "2016-05-07T00:56:24Z")

</div>

To summarize a team discussion today, we decided that we'll start  
wrapping up development for Bro 2.5.

There's a lot of new functionality in git master now, and it will be  
good to get that all into general use. The main piece missing from our  
original 2.5 roadmap is porting the Bro Cluster to Broker. While much  
of that work is in place already in a development branch, we are going  
to postpone integration for now and will instead merge it at the  
beginning of the upcoming 2.6 development cycle. That way we will have  
more time for testing stability and performance of that new cluster  
setup.

For 2.5, we're still targetting a few more pieces that aren't yet in  
master, including:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- Fixing the flare code to improve performance.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- New SMB and NTP analyzers.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- A simpler Broker API.

Furthermore, if there are any tickets pending that you'd like Bro 2.5  
to address, now would be a good time to point them out.

Robin

---

<div class="post-metadata">

**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\
**Post date:** [May 7, 2016, 8:36am UTC](https://community.zeek.org/t/2-5-roadmap/4144/2 "2016-05-07T08:36:46Z")

</div>

> Furthermore, if there are any tickets pending that you'd like Bro 2.5  
> to address, now would be a good time to point them out.

Coordinated with Seth I have done some refactoring of the  
intel-framework  
([GitHub - J-Gras/zeek at topic/jgras/intel-update](https://github.com/J-Gras/bro/tree/topic/jgras/intel-update)). There are  
only two changes left to do:  
- adding Seth's extension mechanism  
- adding expiration for items  
I would be happy to finish that and open a pull request if you consider  
this as relevant for 2.5. In case, what would be the deadline for the PR?

Best regards,  
Jan

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [May 9, 2016, 4:48pm UTC](https://community.zeek.org/t/2-5-roadmap/4144/3 "2016-05-09T16:48:58Z")

</div>

We don't have a concrete deadline yet, it'll most likely take a few  
more weeks until we call a feature freeze. I'll let Seth comment on  
content but generally merging your changes in for 2.5 certainly sounds  
good to me.

Robin

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [May 10, 2016, 5:22pm UTC](https://community.zeek.org/t/2-5-roadmap/4144/4 "2016-05-10T17:22:37Z")

</div>

Agreed, looking forward to the changes Jan!

.Seth

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [May 20, 2016, 7:32pm UTC](https://community.zeek.org/t/2-5-roadmap/4144/5 "2016-05-20T19:32:53Z")

</div>

Updates from today's meeting regarding 2.5 progress:

&nbsp;&nbsp;&nbsp;&nbsp;- Seth will send summary of the "flare situation" to bro-dev.

&nbsp;&nbsp;&nbsp;&nbsp;- NTP analyzer is in progress.

&nbsp;&nbsp;&nbsp;&nbsp;- SMB analyzer almost ready for merge. We'll not load it by  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;default. We will put it into policy instead and leave it  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;commented out in local.bro, marked as experimental.

&nbsp;&nbsp;&nbsp;&nbsp;- Intel updates are in the queue.

&nbsp;&nbsp;&nbsp;&nbsp;- New Broker API is in progress.

Also, everybody, please look at tickets:

&nbsp;&nbsp;&nbsp;&nbsp;- Check any 2.5 tickets assigned to you; if you don't think you'll  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;make it, bump to 2.6.

&nbsp;&nbsp;&nbsp;&nbsp;- Assign further tickets to 2.5 that should go in but aren't  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;marked so yet.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/2-5-roadmap/4144/6 "2022-05-06T15:43:39Z")

</div>


