&write_expire functionality

Zeek
1

If I have:

global my_table: table[string] of vector of HTTP::Info &write_expire = 5mins;

Will the timeout reset for a particular string entry if I modify a single element within one of the HTTP::Info records?

Best,

Jereme

2

Unfortunately I don’t think it will. Mutable types break some assumptions in Bro and this is one of them. I will do some testing this afternoon to verify if that’s actually true though.

.Seth

3

Whoops, I replied off list. For everyone else’s sake, here’s what I came to based on digging around a bit…

It doesn’t work that way. You may want to change the record and then save the record back to the table. The snippet would look like this

local x = my_table[index_value];
x$fieldname += 1;
my_table[index_value] = x;

That should make the timeouts work right. :slight_smile:

.Seth