[Bro-Dev] Configurable &write_expire interval

Robin Sommer robin at icir.org
Sat Jun 11 08:10:51 PDT 2016

On Sat, Jun 11, 2016 at 15:36 +0200, you wrote:

> I will have a look. If I am able to fix this I will include this in the
> pull request for the intel updates.

Please create a separate pull request for this one first (you can
merge it into the intel update branch, that'll be fine).

> expire_func statement. In case the table is serialized having a cached
> value set, it would be preferable to use this value, wouldn't it?

It's a question of semantics: what should happen if the Bro
unserializing it has redef'ed the constant to a different value? I
think my intuition would expect to use that modified value after

> I am not sure what the actual performance impact would be. My idea would
> be to cache the value in case of a constant and evaluate it every time
> otherwise. That should combine the best of both approaches.

Yeah, I was thinking about that too. I'd still be curious if the
overhead of re-evaluating the constant overhead becomes noticable. If
you're game, you could try a little benchmark just manipulating a
table plenty times and measure if that changes execution time much.


Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin

More information about the bro-dev mailing list