[Bro] Bro performance issues

Seth Hall seth at icir.org
Mon Oct 31 05:35:54 PDT 2011

On Oct 31, 2011, at 6:45 AM, Tomer Teller wrote:

> All the packets are valid IPv4, I just noticed that my CPU goes to 92% so I am probably suffering drops due to load.

Very likely.  I usually try not to send more than 80-100Mbps of traffic to a single core.

> How do I load worker-1 with 'worker1-policy.bro' and worker-2 with 'worker2-policy.bro' ? The documentation only talks about 'local-worker.bro' that is being loaded by all the workers.

What version are you using?  1.5.x or the 2.0 beta we just released on friday?  The answers to all of your questions will be different based on it. :)


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list