diff --git a/scripts/base/frameworks/software/main.zeek b/scripts/base/frameworks/software/main.zeek index 238810521f..881ba9ee40 100644 --- a/scripts/base/frameworks/software/main.zeek +++ b/scripts/base/frameworks/software/main.zeek @@ -239,7 +239,10 @@ function parse(unparsed_version: string): Description return Description($version=v, $unparsed_version=unparsed_version, $name=alternate_names[software_name]); } +# A cache for the proxies that stores the result of parsing unparsed_version. global parse_cache: table[string] of Description &read_expire=65secs; +# A suppression cache for the workers to prevent sending the same information to the proxies multiple times. +global found_cache: set[Info] &create_expire=10mins; # Call parse, but cache results in the parse_cache table function parse_with_cache(unparsed_version: string): Description @@ -523,6 +526,11 @@ function found(id: conn_id, info: Info): bool if ( ! info$force_log && ! addr_matches_host(info$host, asset_tracking) ) return F; + # This assumes that callers do not fill in info$ts, none of the current callers do. + if ( info in found_cache ) + return T; + add found_cache[info]; + if ( ! info?$ts ) info$ts = network_time();