&write_expire functionality

If I have:

global my_table: table[string] of vector of HTTP::Info &write_expire = 5mins;

Will the timeout reset for a particular string entry if I modify a single element within one of the HTTP::Info records?



Unfortunately I don’t think it will. Mutable types break some assumptions in Bro and this is one of them. I will do some testing this afternoon to verify if that’s actually true though.


Whoops, I replied off list. For everyone else’s sake, here’s what I came to based on digging around a bit…

It doesn’t work that way. You may want to change the record and then save the record back to the table. The snippet would look like this

local x = my_table[index_value];
x$fieldname += 1;
my_table[index_value] = x;

That should make the timeouts work right. :slight_smile: