[Bro] write_expire computational time

Robin Sommer robin at icir.org
Tue Apr 25 08:07:06 PDT 2017

On Tue, Apr 25, 2017 at 07:54 -0700, Johanna Amann wrote:

> > if this is the case then write_expire should be O(n), is this correct
> > ?
> The time overhead of expiration is O(n), correct.

To clarify because there could be different interpretations here: it's
indeed O(n) for the whole expire operation, however that is amortized
over a longer time frame: when Bro iterates over the table, it works
on short slices at a time (which is the reason that it can take longer
to expire an element, as Johanna wrote). So it's not O(n) for each
table operation or such.


Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin

More information about the Bro mailing list