Bloomfilter should error out or notify if its saturated

Description

It would be nice to have bloomfilter either Error out or message if its completely filled. At the moment it a completely filled bloomfilter will just say yes for every membership test (which is expected ) but this causes problem.

1) We over estimate the element sizes causing bloomfilter to have extreme numbers (for example I had one which had config of (0.00000001, 1000000000)

2) After a good run of bro we won't know if check in bloom filter is because its filled up or if element was indeed added, causing operational problems and wrong decisions based on bloomfilter.

Here is a test script:

export {
global smtp_bloom: opaque of bloomfilter;
}

event bro_init()
{

smtp_bloom = bloomfilter_basic_init(0.001, 1);
local i = 0;

while ( i < 15 )
{
print ++i ;
bloomfilter_add(smtp_bloom,i);

local seen = bloomfilter_lookup(smtp_bloom,i);
if (seen >0)
print fmt("i %s is seen", i);
}

++i ;

seen = bloomfilter_lookup(smtp_bloom,i);
if (seen >0)
print fmt("i %s is seen", i);
else
print fmt("i %s is NOT seen", i);

}

Environment

bro-2.5 stable release

Assignee

Unassigned

Reporter

Aashish Sharma

Labels

External issue ID

None

Components

Affects versions

Priority

Normal
Configure