From 971808ba3f20415adb99dacab6cfe47bb7097e3a Mon Sep 17 00:00:00 2001 From: Justin Azoff Date: Wed, 22 Sep 2021 07:53:03 -0400 Subject: [PATCH] Avoid allocation of 0 length strings on new conns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New connections already do conn_val->Assign(6, val_mgr->EmptyString()); This second assignment was effectively doing conn_val->Assign(6, "") for all new connections, causing a new empty ZeekString to be allocated. On a pcap containing 100% syn packets this gives a noticeable perf improvement. Benchmark #1: zeek.orig -r /data/pcaps/scan.pcap Time (mean ± σ): 47.082 s ± 0.547 s [User: 57.555 s, System: 9.114 s] Range (min … max): 46.516 s … 47.834 s 5 runs Benchmark #2: zeek -r /data/pcaps/scan.pcap Time (mean ± σ): 45.260 s ± 0.378 s [User: 55.438 s, System: 8.537 s] Range (min … max): 44.783 s … 45.789 s 5 runs Summary 'zeek -r /data/pcaps/scan.pcap' ran 1.04 ± 0.01 times faster than 'zeek.orig -r /data/pcaps/scan.pcap' --- src/Conn.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Conn.cc b/src/Conn.cc index dc81cf045f..8f26a944a5 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -271,7 +271,8 @@ const RecordValPtr& Connection::GetVal() conn_val->AssignTime(3, start_time); // ### conn_val->AssignInterval(4, last_time - start_time); - conn_val->Assign(6, history); + if ( history.size() ) + conn_val->Assign(6, history); conn_val->SetOrigin(this);