[Bro] Large flows

William Jones jones at tacc.utexas.edu
Mon May 16 11:25:02 PDT 2011

I have a few machines that can produce large flows in access 100Mbytes over NLR.  This cause bro to drop packets.  Right now I am using pcap filters and extra workers on the sensor machine to insures that only packets dropped are from the file transfers machines.   This is not that big down side but it make we wonder if just what is the biggest flow that bro can handle on a single cpu.   

More information about the Bro mailing list