
3/4/2019 · Ingvar Stepanyan, Andrew Galloni
What this post added
This post details the design of Cloudflare's open-sourced Rust library for Wireshark-like filters, 'wirefilter'. It explains the decision to use manual parsing over parser generators due to the need for contextual parsing of ambiguous syntax (e.g., IPv6 addresses vs. byte sequences). It also describes optimizations to the execution engine, specifically replacing HashMap lookups with fixed-size array indexing for field access by resolving field names to indices during parsing and storing them in the AST, resulting in approximately 2x speed improvements.