LaBrea: mitigate too big events again

hp-labrea/labrea-idea.py

@@ -35,7 +35,7 @@ class WindowContextMgr(object):
         self.first_update_queue = OrderedDict()
         self.last_update_queue = OrderedDict()
         # Hammer to mitigate too big events
-        self.max_count = 2000
+        self.max_count = 200
         self.max_src_ports = 1024
 
     def expire_queue(self, queue, window):
@@ -154,7 +154,7 @@ class ConnectContextMgr(WindowContextMgr):
         ctx["src_ports"].add(event.src_port)
         ctx["count"] += 1
         ctx["last_update"] = self.update_timestamp
-        return ctx["count"] < self.max_count
+        return len(ctx["tgt_ips_ports"]) < self.max_count
 
     def ctx_close(self, ctx):
         src_ports = ctx["src_ports"] if len(ctx["src_ports"]) <= self.max_src_ports else None