Arne Welzel

> I did not check which other operations can trigger such an update. zkg list seems to trigger the two you showed as well: ``` $ make zkg -vv list...

@jacopofar , @asherp, @aliashkar - any chance there is a stacktrace in the logs before the "killed by signal 11" line and could paste it here? It would also be...

> I would be surprised to see any significant difference, but did you check the performance impact? I have not, this probably needs a patched Zeek version to not call...

It seems gopacket does not use a auxiliary data structure: https://github.com/google/gopacket/blob/32ee38206866f44a74a6033ec26aeeb474506804/afpacket/afpacket.go#L450-L452 They do keep a header for the current block to avoid computing it for every packet anew, but the...

Reopening as the change was reverted with #179

Late follow-up for the record (with #2982 as background): I've redone the distribution of 1mio intel entries in @pbcullen / @JustinAzoff environment. The crux there is that the packet source...

As an addition, #2859 should have also improved on the above. `ExtractNextPacket()` was called within `GetNextTimeout()` previously and that would introduce yet anothre 1msec sleep with that packet source, so...

> I've redone the distribution of 1mio intel entries in @pbcullen / @JustinAzoff environment. The crux there is that the packet source blocks for 1msec in ExtractNextPacket() for a packet...

I have not, but haven't specifically looked, either.

>> it makes more sense for Zeek nodes to connect out to those services, rather than the other way around. > Would you mind explaining the use case a bit?...