Use of suspend_processing and continue_processing messes up network_time

Zeek
1

Dear all,

Have anyone using suspend_processing() and continue_processing() have problem with the network_time() function? I found that when those two functions are used, sometimes network_time() called for each packet all return the same time. Since network_time() returns the network time of the last packet processed, I guess this has something to do with the suspend_processing() and continue_processing() messing up the order of when the event for each packet is triggered.

Any idea? Any help is appreciated.

Best,
Wenyu

Wenyu Ren
Ph.D. Candidate
Department of Computer Science
University of Illinois at Urbana-Champaign

2

To be more specific, I found sometimes (sometimes not) the network_time() will return the current wall time instead of the packet time if suspend_processing and continue_processing are used.

Wenyu Ren
Ph.D. Candidate
Department of Computer Science
University of Illinois at Urbana-Champaign

3

This sounds like a bug - if this is easily reproducable, could you create
a ticket on the tracker containing the steps on how to reproduce this?

Thanks :slight_smile:
Johanna