On 26 Apr 2018, at 14:04, Vern Paxson wrote:
In implementing bitwise operations for counts (now
pretty much done!),
I found that Bro's internals actually support "||" and
p1 || p2 returns a pattern that matches either p1 or p2
p1 && p2 returns a pattern that matches p1 followed by p2
(Note that this second is not obvious. One might instead expect it to
return a pattern that matches only if both p1 and p2 match, where the
This doesn't appear to be documented anywhere. I discussed it with
and we both agree that this seems weird and likely not used anywhere.
Therefore we're thinking we should deprecate it and eventually remove
Sounds fine to me - I totally was not aware of this. Though having the
functionality of the former available in some form would be kind of
nice-I have a few scripts where I would have used that.