[Zeek-Dev] Hi + LL Analyzer

Jan Grashöfer jan.grashoefer at gmail.com
Thu Feb 28 02:35:01 PST 2019


On 27/02/2019 20:40, Robin Sommer wrote:
>> One question here would be whether it makes sense to assume that the set of
>> LL-analyzers tash should be available is known at compile-time?
> 
> The built-in ones can be known, but any added through dynamic plugins
> can't really. We'll know only at runtime what the final set is. But we
> could precompute a lookup table in advance at startup that maps link
> types to analyzers.

The question here would be whether LL-analyzers have to be linked 
dynamically. Another option would be to require users to build Zeek if 
they need additional LL-analyzers. The analyzers would still be modular 
but using some meta programming one might be able to generate efficient 
dispatching code at compile-time. If the focus is on performance we 
could benchmark both approaches and decide based on the results.

Jan


More information about the zeek-dev mailing list