[Bro] High orig_bytes value

Danilo Nicolò dani.nicolo at gmail.com
Mon Aug 29 10:01:17 PDT 2016

Hello guys,

I'm testing Bro 2.5 beta with netmap, and I noticed this row:


If you look at this log, you can see that there was 4gb data exchanged in
0sec, that's impossible.
I followed the netmap installation guide by patching the igb intel driver
and so using libpcap system (version 0.8)

Anyone has had this kind of problem? Might it be a netmap problem? Should I
use pf_ring instead?

Thanks in advance,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160829/d2c53787/attachment.html 

More information about the Bro mailing list