[Bro-Dev] early performance comparisons of CAF-based run loop

Siwek, Jon jsiwek at illinois.edu
Thu Apr 20 20:13:37 PDT 2017


> On Apr 20, 2017, at 12:40 PM, Robin Sommer <robin at icir.org> wrote:
> 
> I need to think about that argument ... Did you try reading from files
> while also doing communication (that would be pseudo-realtime mode),
> or was the pcap the only source of input?

Tested:

* pcap
* pcap + script doing DNS queries
* live interface
* live interface + script doing DNS queries 

Untested:

* anything with remote communication
* pseudo-realtime

- Jon



More information about the bro-dev mailing list