[Bro] building a new bro server

Seth Hall seth at icir.org
Tue Dec 9 10:00:48 PST 2014

> On Dec 8, 2014, at 10:57 PM, Allen, Brian <BrianAllen at wustl.edu> wrote:
> We saw a huge improvement when we went from 16Gig RAM to 128Gig RAM. (That one was pretty obvious so we did that first).  We also saw improvement when we pinned the processes to the cores.

I think I had also suggested that you move to tcmalloc.  Have you tried that yet?  It’s not going to fix your issue with 30% packet loss, but I expect it would cut it down a bit further.

Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list