[Bro] Select Loop
joel.ebrahimi at gmail.com
Wed Apr 2 14:12:36 PDT 2008
Its based of Suse on a powerpc architecture.
The stalls only seemed to happen when there are filtered packets. If I had
redefined my capture_filters to accept all traffic the stalls do not happen.
On Wed, Apr 2, 2008 at 1:43 PM, Robin Sommer <robin at icir.org> wrote:
> On Wed, Apr 02, 2008 at 13:20 -0600, Joel Ebrahimi wrote:
> > I have been working on Bro on both an Intell and Bivio platform. On the
> > Bivio system there is some strange occurence where if I my
> > are excluding traffic it will cause the application to periodically
> > and completley destroy performance.
> What OS is the Bivio platform running? We've recently been seeing
> stalls with FreeBSD 7 which sound pretty similar to what you
> describe. My guess is that the FB7 problems are related to
> non-blocking pcap as well because Bro seems to be the only
> application which triggers them.
> > This build will not to communicate with other nodes so this sounds like
> > perfect solution.
> (There's actually a bit more functionality which in principle could
> stall, such as async DNS lookups (not a problem) or the new NetFlow
> analyzer (which isn't in trunk yet)). But in any case, as long as
> you have a steady stream of packets on the wire, pcap will always
> have something to pass back to Bro and thus not block anyway.)
> Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
> ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro