Connection dictionaries

Zeek
1

I see that there are different connection dictionaries for tcp, udp
and icmp connections. These are indexed by originator/responder
ip/port 4-tuple. Is there a specific reason (apart from performance
maybe?) for going with this approach rather than creating a single
dictionary indexed by a 5-tuple, 5th-tuple being the protocol?

thanks
-y

2

Is there a specific reason (apart from performance
maybe?) for going with this approach rather than creating a single
dictionary indexed by a 5-tuple, 5th-tuple being the protocol?

That structure arose due to how the code evolved. Using 4-tuples instead
of 5-tuples saves a small amount of memory, too.

    Vern