[Bro-Dev] help Reading the backtrace

[Robin Sommer]

On Thu, Jan 19, 2017 at 09:44 -0800, you wrote:

> Still, to clearify, there might be a possibility that because at
> present table_incremental_step=5000, somehow expiring >> 5000 entries
> continiously every moment might cause cause Queue to deadlock
> resulting in BRO to stop packets processing ?

It shouldn't deadlock. What I can see happening, depending on load and
these parameters, is Bro spending most of its time going through the
table to expire entries and only getting to few packets in between (so
not complete stop of processing, but not getting much done either)

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin