[Bro-Dev] Bro 2.6-beta plans

[Azoff, Justin S]

> On Sep 7, 2018, at 4:41 PM, Azoff, Justin S <jazoff at illinois.edu> wrote:
> 
> Before, cpu maxed out but spending 60% in user and 30% in system
> After, cpu maxed out but spending 12% in user and 80% in system
> 

I did some more testing and profiling and figured out what is going on..

The new version is much more efficient, so it's spending a lot less time in user space
and a lot more time in the kernel fetching packets.

On the managers, overall CPU using is a bit lower, but I think some of that is from removing all uses
of &synchronized, especially for large input tables.

If anything there's just a slight overhead in the bro-myricom plugin in how it uses snf_ring_recv to
receive a single packet instead of snf_ring_recv_many to grab multiple packets like how af_packet works.

I'd look into fixing it but we are moving to intel 40g cards anyway.



— 
Justin Azoff