[Bro] Side effects on record fields when triggering events

Vern Paxson vern at icir.org
Tue Aug 30 21:47:26 PDT 2005


> Okay Chema and I tracked it down to the reference counting that is going
> on in the core

Exactly.  Aggregates in Bro are passed as shallow copiess, not deep copies.
There are times when it would be handy to have an operator to specify
deep-copy semantics.  I share your concern at the counter-intuitive behavior
that shallow-copy semantics can provide, but blanket deep-copy can be very
expensive, and needlessly so in many cases.

		Vern



More information about the Bro mailing list