[Bro-Dev] Bloom filter interface

[Seth Hall]

On Jun 5, 2013, at 11:03 AM, Robin Sommer <robin at icir.org> wrote:

> On Tue, Jun 04, 2013 at 15:24 -0700, you wrote:
> 
>> (4) bloomfilter_merge(bf1: opaque of bloomfilter, bf2: opaque of
>> bloomfilter) : bool
> 
> Is this merging bf2 into bf1? Would it make sense to return a new
> "opaque of bloomfilter" instead? 

>From a clarity perspective I think that returning a bloom filter makes the most sense.  From a performance perspective I can see the desire to do a merge to the left approach that Matthias is proposing.

> Alternatively, we might need a
> bloomfilter_copy() for the case that one wants to merge without
> destroying any of the original filters.

Could we just make the existing copy bif work with it?  Now that I know how that's implemented internally though I'm already skeptical of the idea. :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/