[Bro-Dev] Bloom filter interface
seth at icir.org
Wed Jun 5 08:32:22 PDT 2013
On Jun 5, 2013, at 11:03 AM, Robin Sommer <robin at icir.org> wrote:
> On Tue, Jun 04, 2013 at 15:24 -0700, you wrote:
>> (4) bloomfilter_merge(bf1: opaque of bloomfilter, bf2: opaque of
>> bloomfilter) : bool
> Is this merging bf2 into bf1? Would it make sense to return a new
> "opaque of bloomfilter" instead?
>From a clarity perspective I think that returning a bloom filter makes the most sense. From a performance perspective I can see the desire to do a merge to the left approach that Matthias is proposing.
> Alternatively, we might need a
> bloomfilter_copy() for the case that one wants to merge without
> destroying any of the original filters.
Could we just make the existing copy bif work with it? Now that I know how that's implemented internally though I'm already skeptical of the idea. :)
International Computer Science Institute
(Bro) because everyone has a network
More information about the bro-dev