[Bro] Problem: Bro listening on two ethernet interfaces

Robin Sommer sommer at in.tum.de
Tue May 24 00:31:48 PDT 2005


On Mon, May 23, 2005 at 12:19 -0700, Christian wrote:

> Maybe IOSourceRegistry::FindSoonest() would be a good place to
> start digging.

As a general note, the IOSource code is still rather new and may not
yet perform optimal in all cases. The major problem is that the
precise semantics of the libpcap interface varies depending on OS
version and libpcap version (and patches to either of them). I would
not be suprised if the problem w/ two Linux interfaces is related to
this.

I'd be happy to help sorting this out. However, I don't have a Linux
machine at hand which has two interfaces seeing a high-volume stream
(and I am a bit tight on time right now...).

Robin

-- 
Robin Sommer * Room        01.08.055 * www.net.in.tum.de
TU Muenchen  * Phone (089) 289-18006 *  sommer at in.tum.de 



More information about the Bro mailing list