regarding mechanism , policy.

Ashley Thomas athomas at
Wed Dec 26 13:56:24 PST 2001


It is very advantageous to have mechanism and policy separated
(as mentioned in Bro paper) but does it incur any overhead ?

The paper says: for each event passed to the interpreter,
it retrieves the (semi-) compiled code for the corresponding handler,
binds the values of the events to the arguments of the handler, and
interprets the code.

Would'nt this take some extra time compared to if it was already compiled?
(although the flexibility is lost in the latter case)

thanks a lot

More information about the Bro mailing list