[Bro] Problem: Bro listening on two ethernet interfaces

Robin Sommer sommer at in.tum.de
Tue May 10 08:47:00 PDT 2005


On Tue, May 10, 2005 at 12:50 +0200, Christoph Goeldi wrote:

> on various interfaces. bro still drops most of the packets
> when i force it to listen on two interfaces.

I haven't used multiple interfaces myself yet, but in general
capturing seems to be more problematic on Linux than on FreeBSD.
With a stock Linux kernel, the performance is actually rather bad.
It works much better with Phil Wood's mmap pcap[1]. We've also
experimented with Luca Deri's RING patch, but there were some
strange problems (like not filtering correctly), and it doesn't
support SMP systems. 

That said, could you try configuring Bro with --enable-selectloop
and see if that changes anything?

Robin

[1] Although rather recently I have encountered some weird
timestamps when using it...

-- 
Robin Sommer * Room        01.08.055 * www.net.in.tum.de
TU Muenchen  * Phone (089) 289-18006 *  sommer at in.tum.de 



More information about the Bro mailing list