[Bro] Memory consumption of a single table entry
vern at icir.org
Sun Mar 6 00:41:39 PST 2005
> The tables is, as given below, indexed by destination IP and the entries are of
> type bool. One entry uses 139 Bytes (= 1340 KB / 9844 entries).
> I do not understand why one entry uses that much of memory.
Robin Sommer profiled this and the short answer is yes, it winds up taking
about that much memory (the exactly value depends on a number of things)
:-(. This is clearly unhappily high. It comes from run-time typing
information, timestamps used for table expiration, location information
for error message output, and hash table buckets, keys & chains. We'll
be looking into ways to lower it, but this will take a while.
More information about the Bro