diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc index cf63c18717..af78638394 100644 --- a/src/analyzer/Manager.cc +++ b/src/analyzer/Manager.cc @@ -51,7 +51,8 @@ bool Manager::ConnIndex::operator<(const ConnIndex& other) const { return false; } -Manager::Manager() : plugin::ComponentManager("Analyzer", "Tag", "AllAnalyzers") {} +Manager::Manager() + : plugin::ComponentManager("Analyzer", "Tag", "AllAnalyzers"), tag_cache(2048, nullptr) {} Manager::~Manager() { // Clean up expected-connection table. @@ -259,7 +260,20 @@ bool Manager::UnregisterAnalyzerForPort(const zeek::Tag& tag, TransportProto pro } Analyzer* Manager::InstantiateAnalyzer(const zeek::Tag& tag, Connection* conn) { - Component* c = Lookup(tag); + // std::fprintf(stderr, "Instantiate %d %d\n", tag.Type(), tag.Subtype()); + + Component* c = nullptr; + + // Check for the tag in the tag cache + if ( c = tag_cache[tag.Type()]; c ) { + if ( c->Tag().Subtype() != tag.Subtype() ) + reporter->InternalWarning("tag caching problem"); + } + else { + // Slow lookup path + c = Lookup(tag); + tag_cache[tag.Type()] = c; + } if ( ! c ) { reporter->InternalWarning("request to instantiate unknown analyzer"); diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h index 6657b5f2d9..a122860c65 100644 --- a/src/analyzer/Manager.h +++ b/src/analyzer/Manager.h @@ -376,6 +376,8 @@ private: conns_map conns; conns_queue conns_by_timeout; std::vector vxlan_ports; + + std::vector tag_cache; }; } // namespace analyzer