On Thu, Feb 28, 2019 at 11:35 +0100, Jan Grashöfer wrote: > The question here would be whether LL-analyzers have to be linked > dynamically.
Well, the point of the plugin API is being able to add new functionality externally through an independently compiled shared library. Excluding link-layer analyzers from that would feel like a gap to me. That said, we definitely need to benchmark performance to make sure it's feasible. My hunch is that a lookup table should be good enough, but we'll see. Robin -- Robin Sommer * Corelight, Inc. * ro...@corelight.com * www.corelight.com _______________________________________________ zeek-dev mailing list zeek-dev@zeek.org http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek-dev
