[Bro] Bro performance issues

Seth Hall seth at icir.org
Thu Nov 3 12:48:38 PDT 2011

On Nov 3, 2011, at 3:40 PM, William Jones wrote:

> Don’t you need more foo to get PF_RING to load balance  it looks like you have to bind a bro instances to a cpu?

Nope, and if you build Bro against the PF_RING libpcap wrapper BroControl automatically takes care of everything to begin load balancing.  I'm still waiting to hear back from Tomer with the output from the commands I asked him for earlier to actually figure out what's going wrong for him.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list