On Sat, Jun 11, 2016 at 15:36 +0200, you wrote:
> I will have a look. If I am able to fix this I will include this in the > pull request for the intel updates. Please create a separate pull request for this one first (you can merge it into the intel update branch, that'll be fine). > expire_func statement. In case the table is serialized having a cached > value set, it would be preferable to use this value, wouldn't it? It's a question of semantics: what should happen if the Bro unserializing it has redef'ed the constant to a different value? I think my intuition would expect to use that modified value after unserialization. > I am not sure what the actual performance impact would be. My idea would > be to cache the value in case of a constant and evaluate it every time > otherwise. That should combine the best of both approaches. Yeah, I was thinking about that too. I'd still be curious if the overhead of re-evaluating the constant overhead becomes noticable. If you're game, you could try a little benchmark just manipulating a table plenty times and measure if that changes execution time much. Robin -- Robin Sommer * ICSI/LBNL * [email protected] * www.icir.org/robin _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
