[Bro] A few questions

Tim Rupp tarupp at fnal.gov
Thu Feb 4 05:41:13 PST 2010

For the sake of future reference (and my own curiosity) can I request
the filter be sent to the list?


On 02/03/2010 11:03 AM, Robin Sommer wrote:
> On Tue, Feb 02, 2010 at 13:53 -0500, Powell, Scott wrote:
>> Given our current setup, how would I go about these BPF tricks to
>> leverage multiple cores on a single machine?
> The click setup already mentioned is probably the better solution,
> but when using BPF, you would give each worker a different BPF
> filter ignoring all but its slice of the traffic. One can express
> the hash "(src+dst) mod n" in BPF (let me know if you want the exact
> filter).
> Robin

More information about the Bro mailing list