[Bro] Capture Loss
af7 at umbc.edu
Tue Mar 7 07:34:23 PST 2017
I'm running Bro in a clustered configuration using PF_RING to have 8
separate workers on one box. Additionally, I have commented out almost
everything in the default local.bro to run in Bro as efficiently as
possible. Together, these 8 workers are using less than 20% of total CPU
However, we are experiencing capture loss consistently in the 50% range,
even though CPUs are idle 80% of the time on average.
Does anyone have any experience with this? I would greatly appreciate the
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro