[Bro] About Bro drop packet....

[Robin Sommer]

On Wed, Jan 17, 2007 at 16:26 +0800, ?i?A?? wrote:

> In info.localhost.06-12-27_13.16.39 file , I find a lots of packets be droped, why? is it right? 

Well, it's not "right" in the sense that naturally you don't want to
drop any packets at all. Drops occur if the system cannot keep up
with the packet stream, which can have various reasons. 

> if not, and how to improve it?

What kind of system are you using? In general, Linux is not the best
choice for packet capturing, yet you might be able to improve
performance somewhat with a little bit of tweaking, see
http://www.net.t-labs.tu-berlin.de/research/bpcs

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org