[Bro] Problem: Bro listening on two ethernet interfaces
goeldich at ee.ethz.ch
Tue May 17 04:08:23 PDT 2005
Zitat von Robin Sommer <sommer at in.tum.de>:
> On Tue, May 10, 2005 at 12:50 +0200, Christoph Goeldi wrote:
>> on various interfaces. bro still drops most of the packets
>> when i force it to listen on two interfaces.
> I haven't used multiple interfaces myself yet, but in general
> capturing seems to be more problematic on Linux than on FreeBSD.
> With a stock Linux kernel, the performance is actually rather bad.
> It works much better with Phil Wood's mmap pcap. We've also
> experimented with Luca Deri's RING patch, but there were some
> strange problems (like not filtering correctly), and it doesn't
> support SMP systems.
Thank you for the tip, we are already evaluating Phil Wood's mmap pcap.
> That said, could you try configuring Bro with --enable-selectloop
> and see if that changes anything?
I tried the --enable-selectloop option and it doesn't seem to change
anything. Listening on two interfaces still doesn't work... :-(
Thank you anyway
More information about the Bro