[Bro] Problem: Bro listening on two ethernet interfaces

[Christoph Goeldi]

Hi Robin

Zitat von Robin Sommer <sommer at in.tum.de>:
>
> On Tue, May 10, 2005 at 12:50 +0200, Christoph Goeldi wrote:
>
>> on various interfaces. bro still drops most of the packets
>> when i force it to listen on two interfaces.
>
> I haven't used multiple interfaces myself yet, but in general
> capturing seems to be more problematic on Linux than on FreeBSD.
> With a stock Linux kernel, the performance is actually rather bad.
> It works much better with Phil Wood's mmap pcap[1]. We've also
> experimented with Luca Deri's RING patch, but there were some
> strange problems (like not filtering correctly), and it doesn't
> support SMP systems.

Thank you for the tip, we are already evaluating Phil Wood's mmap pcap.

> That said, could you try configuring Bro with --enable-selectloop
> and see if that changes anything?

I tried the --enable-selectloop option and it doesn't seem to change
anything. Listening on two interfaces still doesn't work... :-(


Thank you anyway
Christoph