[Bro] A explaination of

William Jones jones at tacc.utexas.edu
Fri Apr 19 08:59:09 PDT 2013

                # Someone's going to have to explain what this is and add a field to the Info record.
                #info$util = 100.0*((res$user_time + res$system_time) - (last_res$user_time + last_res$system_time))/(now-last_ts);

This is just an estimate of the cpu utilization to process the packets.   If you seeing lost packets and this number is a 100% then you run out of the processing power for that worker.

Most of my dropped packets are due to running out of cpu.   This mostly happens during denial of serves attach when some is try to use TACC resole to generate icmp replies.  Were carefully not generate icmp messages in most cases.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130419/1793acaf/attachment.html 

More information about the Bro mailing list