[Bro] Bro performance issues

Seth Hall seth at icir.org
Tue Nov 1 07:05:58 PDT 2011

On Nov 1, 2011, at 8:57 AM, Gregor Maier wrote:

> In terms of performance please note that using the new_packet() event 
> generates a lot of overhead so the performance you see is
> going to be significantly worse than in "normal" operation.

Oh, good point.  I should add something to the warnings file that prints out if you are handling that event to make sure people understand how badly it can impact performance.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list