[Bro] Throughput Problems

Joel Ebrahimi joel.ebrahimi at gmail.com
Tue Mar 11 19:46:04 PDT 2008

I also just tested this on a dual core intel platform running FC 6.
I get the same exact behavior. In this case I did the following:

make install
make install-brolite

( i had to remove the pre-generated parser code as well)

When I remove loading brolite from the site file I get exceptional

With brolite enabled it almost appears as if bro does nothing. When I send a
test pcap with 30K packets bro is only able to proces 1800. The cpu usage of
bro never even gets passed 5%.

// Joel

On Tue, Mar 11, 2008 at 7:10 PM, Joel Ebrahimi <joel.ebrahimi at gmail.com>

> I am running using Suse on PowerPC. I am also using specialty hardware
> from Bivio.
> I do not belive it is an issue with BPF.
> // Joel
> On Tue, Mar 11, 2008 at 5:21 PM, Vern Paxson <vern at icir.org> wrote:
> > What OS are you running under?  First immediate guess is that your
> > BPF buffers are much too small.
> >
> >                Vern
> >
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20080311/3c689e41/attachment.html 

More information about the Bro mailing list