[Bro] Throughput Problems
joel.ebrahimi at gmail.com
Tue Mar 11 19:46:04 PDT 2008
I also just tested this on a dual core intel platform running FC 6.
I get the same exact behavior. In this case I did the following:
( i had to remove the pre-generated parser code as well)
When I remove loading brolite from the site file I get exceptional
With brolite enabled it almost appears as if bro does nothing. When I send a
test pcap with 30K packets bro is only able to proces 1800. The cpu usage of
bro never even gets passed 5%.
On Tue, Mar 11, 2008 at 7:10 PM, Joel Ebrahimi <joel.ebrahimi at gmail.com>
> I am running using Suse on PowerPC. I am also using specialty hardware
> from Bivio.
> I do not belive it is an issue with BPF.
> // Joel
> On Tue, Mar 11, 2008 at 5:21 PM, Vern Paxson <vern at icir.org> wrote:
> > What OS are you running under? First immediate guess is that your
> > BPF buffers are much too small.
> > Vern
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro