[Bro] Large flows

William Jones jones at tacc.utexas.edu
Mon May 16 11:25:49 PDT 2011


-----Original Message-----
From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf Of William Jones
Sent: Monday, May 16, 2011 1:25 PM
To: bro at ICSI.Berkeley.EDU
Subject: [Bro] Large flows

I have a few machines that can produce large flows in access 100Mbytes over NLR.  This cause bro to drop packets.  Right now I am using pcap filters and extra workers on the sensor machine to insures that only packets dropped are from the file transfers machines.   This is not that big down side but it make we wonder if just what is the biggest flow that bro can handle on a single cpu.   

Bro mailing list
bro at bro-ids.org

More information about the Bro mailing list