[Bro] Bro performance issues

Seth Hall seth at icir.org
Wed Nov 2 12:58:10 PDT 2011

On Nov 2, 2011, at 3:41 PM, William Jones wrote:

> Try the following pcap filtering trick:
> [worker-1]
> type=worker
> host=localhost
> interface=em0
> aux_scripts=q1of2

Nice one!  

In the 2.0-beta you don't even need to define that aux_scripts field either.  You should be able to just make files named worker-1.local.bro and worker-2.local.bro in your <prefix>/share/bro/site/ directory and they will automatically get loaded by the correct nodes.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list