[Bro] write_expire computational time

[Johanna Amann]

Hi,

the main function implementing expiry is TableVal::DoExpire in Val.cc
(approximately line 2175).

> Basically, I want to know if I have a table with n elements, and each
> element should expire 1 minute after its insertion - will bro loop over all
> elements in the list checking if they are expired ?

Yes, Bro will loop over all elements from time to time, setting internal
timeouts that cause a loop over the whole table removing expired elements.
Note that elements are not guaranteed to expire after the expiration time;
they will be removed sometime after expiration time, but it can take a
bit.

> if this is the case then write_expire should be O(n), is this correct ?

The time overhead of expiration is O(n), correct.

Johanna