From f086928c5c6b4a0cf8996fea943426d5467e8a81 Mon Sep 17 00:00:00 2001 From: Justin Azoff Date: Fri, 26 Jun 2020 18:51:09 -0400 Subject: [PATCH] reduce memory usage of ConnPolling Instead of scheduling the event with the full 'connection' record, schedule it with the smaller 'conn_id' record. --- scripts/base/protocols/conn/polling.zeek | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/scripts/base/protocols/conn/polling.zeek b/scripts/base/protocols/conn/polling.zeek index 51d5dc9117..03ba514ba3 100644 --- a/scripts/base/protocols/conn/polling.zeek +++ b/scripts/base/protocols/conn/polling.zeek @@ -26,14 +26,14 @@ export { cnt: count, i: interval); } -event ConnPolling::check(c: connection, +event ConnPolling::check(id: conn_id, callback: function(c: connection, cnt: count): interval, cnt: count) { - if ( ! connection_exists(c$id) ) + if ( ! connection_exists(id) ) return; - lookup_connection(c$id); # updates the conn val + local c = lookup_connection(id); # updates the conn val local next_interval = callback(c, cnt); if ( next_interval < 0secs ) @@ -46,5 +46,6 @@ function watch(c: connection, callback: function(c: connection, cnt: count): interval, cnt: count, i: interval) { - schedule i { ConnPolling::check(c, callback, cnt) }; + local id = c$id; + schedule i { ConnPolling::check(id, callback, cnt) }; }