[Bro] About Bro drop packet....

Robin Sommer robin at icir.org
Wed Jan 17 08:53:17 PST 2007

On Wed, Jan 17, 2007 at 16:26 +0800, ?i?A?? wrote:

> In info.localhost.06-12-27_13.16.39 file , I find a lots of packets be droped, why? is it right? 

Well, it's not "right" in the sense that naturally you don't want to
drop any packets at all. Drops occur if the system cannot keep up
with the packet stream, which can have various reasons. 

> if not, and how to improve it?

What kind of system are you using? In general, Linux is not the best
choice for packet capturing, yet you might be able to improve
performance somewhat with a little bit of tweaking, see


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list