[Bro] Packet Drops

Seth Hall seth at icir.org
Thu May 10 05:25:54 PDT 2012

On May 9, 2012, at 8:32 PM, Tom OBrion wrote:

> #fields	ts	ts_delta	peer	gaps	acks	percent_lost
> #types	time	interval	string	count	count	string
> 1336608708.135106	900.000206	bro	996	721708	0.138%
> 1336609608.135122	900.000016	bro	805	705801	0.114%

Now that actually looks really nice.  Did you say that you are running PF_Ring?  I trust the data from the NIC even less when using any of the various things that bypass the normal OS data flow (but I'm not saying that's a bad thing!).

Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list