[Bro] About Bro drop packet....
robin at icir.org
Wed Jan 17 08:53:17 PST 2007
On Wed, Jan 17, 2007 at 16:26 +0800, ?i?A?? wrote:
> In info.localhost.06-12-27_13.16.39 file , I find a lots of packets be droped, why? is it right?
Well, it's not "right" in the sense that naturally you don't want to
drop any packets at all. Drops occur if the system cannot keep up
with the packet stream, which can have various reasons.
> if not, and how to improve it?
What kind of system are you using? In general, Linux is not the best
choice for packet capturing, yet you might be able to improve
performance somewhat with a little bit of tweaking, see
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org
LBNL/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro