[Bro-Dev] Per connection byte and packet counting

[Gregor Maier]

Actually, I was wrong with the &optional fields. I thought they would
always need to allocate memory in the background.
So, I did some more test and here are the results:

* 901 MB  ... baseline trunk

For these, I added two optional counts to the endpoint record, and set
them to NULL:

* 903 MB ... baseline w/ optionals. No counting what-so-ever

In addition, I now added counting (so far still directly in the
TCP_Analyzer and UDP_Analyzer).

* 908 MB ... Counters as uint64_t directly in UDP_Analyzer and
             TCP_Endpoint, but keep optional fields in endpoint
             record as NULL.

* 905 MB ... Counters in their own struct, pointers to this struct
             in UDP_Analyzer and TCP_Endpoint. But pointers are not
             allocated. Optionals are NULL as well.

* 917 MB ... Counters as structs as above, but this time allocated.
             Optionals are NULL (this case is rather pointless, as
             we do count here, but we don't report it)

* 970 MB ... Counters as structs, allocated. Report values in endpoint
             record.

I haven't yet tested the "Counting in separate Child Analyzer, reporting
via connection record's endpoint record". I have to figure out an
elegant way to do this. (See other mail).


BTW, a question, it seems that for optionals I can either assign a NULL
pointer:
  rv->Assign(n, NULL)
or not assign anything at all. The policy-layer seems to handle both
variants in the same way.


cu
Gregor
-- 
Gregor Maier                                             gregor at icir.org
Int. Computer Science Institute (ICSI)          gregor at icsi.berkeley.edu
1947 Center St., Ste. 600                    http://www.icir.org/gregor/
Berkeley, CA 94704
USA