<div>I have been working on Bro on both an Intell and Bivio platform. On the Bivio system there is some strange occurence where if I my capture_filters are excluding traffic it will cause the application to periodically stall and completley destroy performance. Profiling did not really turn up much. I coded in some timers into the code and noticed the stalls were happening in post pcap_next() and prior to calling for the next packet. I never got to the root of the problem but by disabling the select loop my performance sky rocketed!</div>
<div> </div>
<div>This build will not to communicate with other nodes so this sounds like a perfect solution. </div>
<div> </div>
<div>Thanks,</div>
<div> </div>
<div>// Joel <br><br></div>
<div class="gmail_quote">On Wed, Apr 2, 2008 at 12:41 PM, Robin Sommer <<a href="mailto:robin@icir.org">robin@icir.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div class="Ih2E3d"><br>On Tue, Apr 01, 2008 at 18:28 -0700, you wrote:<br><br>> of the event loop. I looked at the code and noticed this will put pcap into<br>> blocking mode, but Im not sure what other impact this may have.<br>
<br></div>That's right, disabling the select loop will let Bro use blocking<br>pcap descriptors. That's the only difference and it is only<br>noticable when using other input than packets as well, in particular<br>
when doing communication with other Bro nodes. If pcap blocks,<br>communication can stall.<br><br>Historically, Bro used to use only blocking descriptors, which we<br>changed when introducing the communication. Initially, the<br>
non-blocking select loop was optional and needed to be turned on<br>explicitly. These days however it is the default and I don't really<br>know any reason to turn it off. The option to go back to blocking is<br>just a relict from the old times.<br>
<br>Any particular reason why you're interested in this?<br><br>Robin<br><font color="#888888"><br>--<br>Robin Sommer * Phone +1 (510) 666-2886 * <a href="mailto:robin@icir.org">robin@icir.org</a><br>ICSI/LBNL * Fax +1 (510) 666-2956 * <a href="http://www.icir.org/" target="_blank">www.icir.org</a><br>
</font></blockquote></div><br>