[Bro-Dev] Hui Lin_Design principle under broccoli

Seth Hall seth at icir.org
Sat Feb 11 17:56:06 PST 2012


On Feb 11, 2012, at 4:18 PM, Hui Lin (Hugo) wrote:

> I am wondering how broccoli client handle this type of situation? It simply drops the second pong events, or store them into some buffer of the broccoli client and drops the event until the buffer is full? 

Someone else will probably give a better answer, but I believe that if there are additional events sent before you check for events again they will be buffered in the socket buffer.  If you expect to have large numbers of buffered events you should be able to increase your OS receive socket buffer size.

 .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/




More information about the bro-dev mailing list