From cc2981ab3b24e94754c7a080fad9f7ba39452348 Mon Sep 17 00:00:00 2001
From: Justin Azoff <justin@corelight.com>
Date: Wed, 9 Jan 2019 13:56:08 -0500
Subject: [PATCH] improve performance of catch and release script

Defer allocation of the Entity record until it will be used.
---
 scripts/base/frameworks/netcontrol/catch-and-release.bro | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/scripts/base/frameworks/netcontrol/catch-and-release.bro b/scripts/base/frameworks/netcontrol/catch-and-release.bro
index 0b87d0bf85..79de7d9662 100644
--- a/scripts/base/frameworks/netcontrol/catch-and-release.bro
+++ b/scripts/base/frameworks/netcontrol/catch-and-release.bro
@@ -428,13 +428,12 @@ function unblock_address_catch_release(a: addr, reason: string &default=""): boo
 
 function catch_release_seen(a: addr)
 	{
-	local e = Entity($ty=ADDRESS, $ip=addr_to_subnet(a));
-
 	if ( a in blocks )
 		{
 @if ( ! Cluster::is_enabled() || ( Cluster::is_enabled() && Cluster::local_node_type() == Cluster::MANAGER ) )
 		local bi = blocks[a];
 		local log: CatchReleaseInfo;
+		local e = Entity($ty=ADDRESS, $ip=addr_to_subnet(a));
 
 		if ( [e,DROP] in rule_entities )
 			{