<div>Hi All,</div>
<div> </div>
<div><font color="#000000">I have been testing Bro recently. I have been having some performance issues. I can load these any and all (without the bad ones listed below) of these policies I get great performance:</font></div>
<font color="#000080"></font><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">
<div><br>@load site<br>@load alarm<br>@load weird<br>@load http<br>@load worm<br>@load blaster<br>@load hot<br>@load signatures<br>@load synflood<br>@load backdoor<br><br><font color="#000000">If I add any single one of these I go from being able to process traffic at 90Mb/s to under 1 Mb/s.<br>
</font><br>@load login <br>@load irc <br>@load portmapper<br>@load http-request<br>@load http-reply<br>@load ftp<br>@load stepping <br>@load tftp<br>@load frag<br>@load smt<font face="Arial" color="navy" size="2">p</font></div>
<div><font face="Arial" color="navy" size="2"></font> </div>
<div><font face="Arial" size="2"><font color="#000000">Has anyone ever seen this problem before? Know the solution? Know to where even start looking?</font></font></div>
<div><font color="#000000"></font> </div>
<div><font color="#000000">I was also curious at waht speeds people start dropping packets. Obviously the traffic your monitoring has an impact so maybe a little background would help too. (ie 100 Mb/s with 64k udp packets)</font></div>
<div><font face="Arial" size="2"><font color="#000000"></font></font> </div>
<div><font face="Arial" size="2"><font color="#000000">Thanks in advance,</font></font></div>
<div><font face="Arial" size="2"><font color="#000000"></font></font> </div>
<div><font face="Arial" size="2"><font color="#000000">// Joel </font></font></div>
<div><font face="Arial" size="2"><font color="#000000"></font></font> </div>
<div><font face="Arial" size="2"><font color="#000000">Joel Ebrahimi</font></font></div></span>
<div>
<p class="MsoNormal"><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> </span></font></p></div>