<div dir="ltr">Robin, All:<div><br></div><div>Here are the graphs for a run of all scan policies (OldScan + new scan.bro, scan_udp.bro, scan_icmp.bro) from a run on a freebsd 9.1 box for approximate 3 day duration. </div><div>
<br></div><div>Memory footprint continues to grow but I have noticed on other systems that memory flattens out around 11G range (after 9 day uninterrupted run). </div><div><br></div><div>CPU is surprisingly low at on this host. (Attached graph). However on other boxes I have seen CPU being high as time progresses. </div>
<div><br></div><div>It seems to me that scan_udp fix is probably working looking at this one data point. I will enable these on other DMZ boxes and lets see if we see same results.</div><div><br></div><div>Aashish </div><div>
<br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Feb 18, 2014 at 2:41 PM, Robin Sommer (JIRA) <span dir="ltr"><<a href="mailto:jira@bro-tracker.atlassian.net" target="_blank">jira@bro-tracker.atlassian.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
[ <a href="https://bro-tracker.atlassian.net/browse/BIT-1138?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15562#comment-15562" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1138?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15562#comment-15562</a> ]<br>
<br>
Robin Sommer commented on BIT-1138:<br>
-----------------------------------<br>
<br>
<br>
<br>
<br>
<br>
Yeah, I keep forgetting that we don't ship that script. But still, I<br>
would like to make sure we understand what was going on there.<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
> UDP scan detection generates a large number of triggers<br>
> -------------------------------------------------------<br>
><br>
> Key: BIT-1138<br>
> URL: <a href="https://bro-tracker.atlassian.net/browse/BIT-1138" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1138</a><br>
> Project: Bro Issue Tracker<br>
> Issue Type: Problem<br>
> Components: Bro<br>
> Reporter: Robin Sommer<br>
> Fix For: 2.3<br>
><br>
><br>
> These triggers then cause high CPU load. We had a fix already but I'm not sure if it has been confirmed that it solved the problem?<br>
<br>
<br>
<br>
--<br>
This message was sent by Atlassian JIRA<br>
(v6.2-OD-09-036#6252)<br>
_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro.org">bro-dev@bro.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
</div></div></blockquote></div><br></div>