[Bro] Multi-Thread bro with pcap file?

Seth Hall seth at icir.org
Fri Apr 17 13:24:05 PDT 2015

> On Apr 15, 2015, at 11:05 AM, Joe Blow <blackhole.em at gmail.com> wrote:
> Can this only be done with one thread?

Alex and Luuk gave answers that will work, but I wanted to throw one more that is coming into the mix too.  Eventually you should be able to use PacketBricks (https://github.com/bro/packet-bricks) to read in pcap files and distribute the traffic out to multiple workers. (just wanted to point out another direction we’re moving).


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list