[Bro] Select Loop

Joel Ebrahimi joel.ebrahimi at gmail.com
Wed Apr 2 12:20:58 PDT 2008


I have been working on Bro on both an Intell and Bivio platform. On the
Bivio system there is some strange occurence where if I my capture_filters
are excluding traffic it will cause the application to periodically stall
and completley destroy performance. Profiling did not really turn up much. I
coded in some timers into the code and noticed the stalls were happening in
post pcap_next() and prior to calling for the next packet. I never got to
the root of the problem but by disabling the select loop my performance sky
rocketed!

This build will not to communicate with other nodes so this sounds like a
perfect solution.

Thanks,

// Joel

On Wed, Apr 2, 2008 at 12:41 PM, Robin Sommer <robin at icir.org> wrote:

>
> On Tue, Apr 01, 2008 at 18:28 -0700, you wrote:
>
> > of the event loop. I looked at the code and noticed this will put pcap
> into
> > blocking mode, but Im not sure what other impact this may have.
>
> That's right, disabling the select loop will let Bro use blocking
> pcap descriptors. That's the only difference and it is only
> noticable when using other input than packets as well, in particular
> when doing communication with other Bro nodes. If pcap blocks,
> communication can stall.
>
> Historically, Bro used to use only blocking descriptors, which we
> changed when introducing the communication. Initially, the
> non-blocking select loop was optional and needed to be turned on
> explicitly. These days however it is the default and I don't really
> know any reason to turn it off. The option to go back to blocking is
> just a relict from the old times.
>
> Any particular reason why you're interested in this?
>
> Robin
>
> --
> Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
> ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20080402/de0e4a6b/attachment.html 


More information about the Bro mailing list