[Bro] Bro performance issues
seth at icir.org
Mon Oct 31 05:35:54 PDT 2011
On Oct 31, 2011, at 6:45 AM, Tomer Teller wrote:
> All the packets are valid IPv4, I just noticed that my CPU goes to 92% so I am probably suffering drops due to load.
Very likely. I usually try not to send more than 80-100Mbps of traffic to a single core.
> How do I load worker-1 with 'worker1-policy.bro' and worker-2 with 'worker2-policy.bro' ? The documentation only talks about 'local-worker.bro' that is being loaded by all the workers.
What version are you using? 1.5.x or the 2.0 beta we just released on friday? The answers to all of your questions will be different based on it. :)
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro