[Bro] Bro performance issues
jones at tacc.utexas.edu
Thu Nov 3 13:27:02 PDT 2011
I will give it a try!
From: Seth Hall [mailto:seth at icir.org]
Sent: Thursday, November 03, 2011 2:49 PM
To: William Jones
Cc: 'Tomer Teller'; Martin Holste; bro at bro-ids.org
Subject: Re: [Bro] Bro performance issues
On Nov 3, 2011, at 3:40 PM, William Jones wrote:
> Don't you need more foo to get PF_RING to load balance it looks like you have to bind a bro instances to a cpu?
Nope, and if you build Bro against the PF_RING libpcap wrapper BroControl automatically takes care of everything to begin load balancing. I'm still waiting to hear back from Tomer with the output from the commands I asked him for earlier to actually figure out what's going wrong for him.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro