zeek/scripts
Jon Siwek d3f88ba9d1 Improve performance of MHR script, addresses BIT-1139.
The MHR script involves a "when" statement which can be expensive due to
the way it clones frames/vals.  In this case, the fa_file record is
expensive to clone, but this change works around that by unrolling only
the necessary fields from it that are needed to populate a Notice::Info
record.  A drawback to this is that the full fa_file or connection
records aren't available in the Notice::Info record when evaluating
Notice::policy hooks for MHR hit notices (though they can possibly be
recovered by using e.g. the lookup_connection() builtin_function).
2014-03-11 13:18:14 -05:00
..
base Improve performance of MHR script, addresses BIT-1139. 2014-03-11 13:18:14 -05:00
broxygen More test updates. 2013-12-04 13:45:03 -08:00
policy Improve performance of MHR script, addresses BIT-1139. 2014-03-11 13:18:14 -05:00
site Update local.bro for Bro 2.2 2013-11-15 11:39:27 -06:00
CMakeLists.txt Don't install test-all-policy.bro script as it's for testing only. 2011-10-12 12:42:12 -05:00
test-all-policy.bro More test updates. 2013-12-04 13:45:03 -08:00