[Bro] dropped packets

Seth Hall seth at icir.org
Thu Mar 6 05:07:55 PST 2014

On Mar 6, 2014, at 7:33 AM, sangdrax8 <sangdrax8 at gmail.com> wrote:

> Well, that explains the interval.  The example I posted was one of the smallest loss amounts, but what is an acceptable or expected loss level?  In the last 6 hours my setup does have a 1448 out of 206031, or .7%.  So .005% seems small, is .7% small?

For most people anything under 1-2% is pretty acceptable.  You could probably work to get rid of that last bit of loss (which I have no clue why that's happening on such a small link) but it's probably more worth your time to start using Bro to achieve some goals within your organization rather than make sure you aren't dropping any packets at all.

> I am running the default local.bro, and it does have misc/scan loaded.  I turn that off and see if I still see loss, but if 1% or less is considered normal loss even for a low load and small traffic, then I guess it is less important. 

Are you running in standalone mode?  I guess I forgot to ask that, but it could be significant.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140306/5398e394/attachment.bin 

More information about the Bro mailing list