[Bro-Dev] Updating / Accessing ConnVal from child analyzers

[Robin Sommer]

On Thu, Dec 09, 2010 at 10:33 -0800, you wrote:

> a) My ConnSize analyzer could just update the ConnVal on every packet.
>    Every analyzer has a pointer to its Conn class. But the pointer is
>    private in Analyzer.h, so derived classes don't have access to it.

(It's private but there is an accessor method, Conn(), so you would
not have to store a copy.)

>    I would also have to update ConnVal on every packet (instead of only
>    when requested by BuildConnVal).

Yeah, that's the part I don't like here. 

> I think a) is really ugly.
>
> What are your thoughts on b)?

b) is really ugly as well. :-) (Even more so than (a) IMHO ...)

Here's another idea:

    - move UpdateEndpointVal() from TransportAnalyzer to Analyzer

    - have BuildConnVal() iterate over the analyzer tree and call
      *every* analyzer's UpdateEndpointVal. Doing so gives all
      analyzers the chance to update the value as appropiate, with
      most often just doing nothing. In principle, there could be
      conflicts with multiple analyzers updating the same fields,
      but in practice that shouldn't happen and we can just declare
      that situation as "undefined".

This adds a tiny bit of overhead but my guess is that it would be
quite a bit less noticable (if at all) than updating the counters
with every packet.

What do you think?

Robn

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org