[Bro] Bro performance issues
seth at icir.org
Tue Nov 1 07:05:58 PDT 2011
On Nov 1, 2011, at 8:57 AM, Gregor Maier wrote:
> In terms of performance please note that using the new_packet() event
> generates a lot of overhead so the performance you see is
> going to be significantly worse than in "normal" operation.
Oh, good point. I should add something to the warnings file that prints out if you are handling that event to make sure people understand how badly it can impact performance.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro