[Bro] Dropped Packets

Seth Hall seth at icir.org
Mon Jun 18 13:22:12 PDT 2012


On Jun 18, 2012, at 4:01 PM, Will Havlovick wrote:

> Per broctl>capstats,  I was averaging between 15-45mbps.


Hm, that seems like an oddly low amount of traffic to see drops on a box like you have.

Could you also try the current master branch in our repository?  The logging framework has been threaded and it's likely that disk latency issues have been resolved to some degree.  Also, I assume these were running Bro in standalone mode?  When running in a cluster this shouldn't have nearly so much effect because the manager process does all of the log writing and it doesn't do any packet processing.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list