Okay Chema and I tracked it down to the reference counting that is going
on in the core
Exactly. Aggregates in Bro are passed as shallow copiess, not deep copies.
There are times when it would be handy to have an operator to specify
deep-copy semantics. I share your concern at the counter-intuitive behavior
that shallow-copy semantics can provide, but blanket deep-copy can be very
expensive, and needlessly so in many cases.
Vern
