[Bro] question about intel files

philosnef philosnef at yahoo.com
Tue Aug 2 05:43:23 PDT 2016

Are intel files loaded into memory or statically evaluated? We have a 7.4 meg intel file we are looking to push; however, out of 400 gigs of ram, we are using 400 gigs, with a load average well over 10.... This is only a 3.5 Gb/s sustained link. We have about 2000 lines of intel (cert hash, file hash, domain) currently. This new addition would drive this up to ~35,000 lines of intel. We are trying to determine if this is practical given our current load on the box.
Also, why does bro continuously chew ram up? When first started, bro eats about 80 gigs, then moves up through the day to about 120-175. However, if we leave it running for a few days, it ends up at the max of the memory allowed for the system...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160802/fdcf39d6/attachment.html 

More information about the Bro mailing list