[Bro] Multi-Thread bro with pcap file?
seth at icir.org
Fri Apr 17 13:24:05 PDT 2015
> On Apr 15, 2015, at 11:05 AM, Joe Blow <blackhole.em at gmail.com> wrote:
> Can this only be done with one thread?
Alex and Luuk gave answers that will work, but I wanted to throw one more that is coming into the mix too. Eventually you should be able to use PacketBricks (https://github.com/bro/packet-bricks) to read in pcap files and distribute the traffic out to multiple workers. (just wanted to point out another direction we’re moving).
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro