[Bro] optimize running bro from PCAPs / advantage of cluster mode

Mike Dopheide dopheide at gmail.com
Fri Sep 29 12:14:32 PDT 2017

> My original question still stands: Are there any parsers which combine
> the information seen by different workers in different flows?

Policies yes, parsers I'm not sure, but I don't believe so.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170929/ee8fb7aa/attachment.html 

More information about the Bro mailing list