[Bro-Dev] Bro + real-time question

Gilbert Clark gc355804 at ohio.edu
Fri Sep 26 12:33:25 PDT 2014


Hi list:

Does anyone know of work that involves placing hard limits on the amount 
of time bro is able to spend processing individual packets? 
Specifically, I'm looking for:

* work toward putting hard limits on the number of cycles Bro is allowed 
to execute per-packet before injecting a hard stop and forcing the 
engine to move to the next packet, or
* work toward emulating buffers / drops based on the number of cycles 
bro spends processing a particular packet in offline / pseudo-realtime mode

Thanks in advance for any references / thoughts!

--Gilbert



More information about the bro-dev mailing list