[Bro-Dev] Maximum number of bytes users should be able to allocate

Matthias Vallentin vallentin at icir.org
Thu Jun 6 14:05:48 PDT 2013

When constructing a Bloom filter, users specify a desired
false-positive rate and a capacity (max number of elements which
guarantee the FP rate), which the implementation uses to allocate
internal storage. Imprudent parametrization can lead to values beyond
the machines memory limits, which would immediately crash Bro. Should
we expect that users only do reasonable parametrizations by clearly
documenting the effects of the parameters? Or should we create hard
caps in the implementation to avoid users shooting themselves in the


More information about the bro-dev mailing list