[Bro-Dev] [JIRA] (BIT-1133) topic/jsiwek/dns-perf

Robin Sommer (JIRA) jira at bro-tracker.atlassian.net
Thu Feb 13 17:25:37 PST 2014

    [ https://bro-tracker.atlassian.net/browse/BIT-1133?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15546#comment-15546 ] 

Robin Sommer commented on BIT-1133:

Merged, with the expected result: time goes down. Two "but" though:

(1) I still see a 2% increase in instructions for tests.m57-short and 1.5% for tests.m57-long, is there something else in DNS that's still quite a bit more expensive now?

(2) I'm wondering if max_pending_query_ids is the right model: a global threshold has the disadvantage that it doesn't scale with the traffic; it's the same for tiny networks as well as with 100Gbps links.  That's ok if, independent of network size, it either rarely kicks or it really doesn't matter much at all when it kicks in; but I can't tell if that's the case here (I haven't looked too closely at the rest of the script's logic yet). So if that were a problem, is there a way to do it per flow instead (or is that what max_pending_msgs is basically already doing?) 

> topic/jsiwek/dns-perf
> ---------------------
>                 Key: BIT-1133
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1133
>             Project: Bro Issue Tracker
>          Issue Type: Improvement
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: Jon Siwek
>              Labels: dns, performance
>             Fix For: 2.3
> Refactored DNS script's state management to improve performance (due to reduced timer volume).
> Branch is in bro, bro-testing, bro-testing-private.

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list