[Bro] Question about processing network traffic

Seth Hall seth at icir.org
Wed Apr 15 05:18:43 PDT 2015

> On Apr 14, 2015, at 6:20 PM, Ren, Wenyu <wren3 at illinois.edu> wrote:
> I have a very basic question about how bro Bro handles network traffic. I am doing some processing on each packet that Bro sees. If the processing time is longer than the packet arriving interval, will Bro block the new packet or buffer the new packet event and deal with it later? If it is buffered, will the event be dropped if the buffer is full?

The packet will be lost once the NIC buffers are exceeded.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list