[Bro-Dev] early performance comparisons of CAF-based run loop

[Siwek, Jon]

> On Apr 12, 2017, at 10:19 PM, Azoff, Justin S <jazoff at illinois.edu> wrote:
> 
> Something that may be optimized for a worker dealing with 1 pktsrc and 2 peers may not be as optimal for a logger/manager that has no pktsrc but 100+ worker connections.  I've often wondered if the event loop should have a hint somewhere about which kind of process is running so it can optimize for throughput vs multiplexing many peers.

Yeah, I’ve thought the same and related with takeaway (2) that I mention in the original post.  It seems like it would be nice to have a more well-defined system for specifying IOSource prioritization or at least between packet sources and other io sources.  Then, since it’s hard to nail down settings that are going to work for all deployments in general, it would also have ways to tune it via scripts so it would be open for a user to tweak settings that may improve for their particular manager, logger, worker, or whatever Bro node they have.

But at the moment, I don’t think there’s a whole lot of info on exactly what tweaks can be made to optimize for the “no pktsrc, but lots of remote comm.” case, and it may be best to wait for the broker integration to become fully realized before investigating that.

- Jon