[Bro] Protocl Analyzer: when to Unref a variable

Valerio valerio.click at gmx.com
Thu Jul 27 23:47:08 PDT 2017

By looking at some analyzers (e.g., sip, TCP) I noticed that some here
and there (usually after the content of a variable is assigned to
another structure with Append) a call to Unref() is made.

Are there any general principles or guidelines regarding when to
explicitly Unref a variable when writing a Bro Analyzer with BinPAC?


More information about the Bro mailing list