[Bro] Problem: Bro listening on two ethernet interfaces
Robin Sommer
sommer at in.tum.de
Tue May 10 08:47:00 PDT 2005
On Tue, May 10, 2005 at 12:50 +0200, Christoph Goeldi wrote:
> on various interfaces. bro still drops most of the packets
> when i force it to listen on two interfaces.
I haven't used multiple interfaces myself yet, but in general
capturing seems to be more problematic on Linux than on FreeBSD.
With a stock Linux kernel, the performance is actually rather bad.
It works much better with Phil Wood's mmap pcap[1]. We've also
experimented with Luca Deri's RING patch, but there were some
strange problems (like not filtering correctly), and it doesn't
support SMP systems.
That said, could you try configuring Bro with --enable-selectloop
and see if that changes anything?
Robin
[1] Although rather recently I have encountered some weird
timestamps when using it...
--
Robin Sommer * Room 01.08.055 * www.net.in.tum.de
TU Muenchen * Phone (089) 289-18006 * sommer at in.tum.de
More information about the Bro
mailing list