[Bro-Dev] open a pipe?

[Seth Hall]

On Mar 26, 2012, at 10:53 AM, Robin Sommer wrote:

>>> global myfile = open("| shasum>  output");
> 
> I'm coming around on this if we move the execution of the pipe into a
> thread. With the new thread infstrastructure, that should be mostly
> straight-forward and get us around all the blocking problems.

Woo.  We definitely need to think about this a bit more though.  I don't really like the perl-ism inherent in writing commands with pipes in the "file name".  I've been looking at node.js's Stream API[1] lately.  We may be able to borrow some ideas from that, but I already see some things about their API that don't like.

> Actually, I'm wondering if non-packet IOSources should generally move
> into threads (e.g., the DNS Mgr).


Do you have any intuitions yet on where we might run into issues with too many threads?  When I was playing around a few nights ago I actually created about a hundred threads. :)

1. http://nodejs.org/api/stream.html

.Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/