[Bro] Throughput Problems

[Joel Ebrahimi]

I also just tested this on a dual core intel platform running FC 6.
I get the same exact behavior. In this case I did the following:

./configure
make
make install
make install-brolite

( i had to remove the pre-generated parser code as well)

When I remove loading brolite from the site file I get exceptional
performance.

With brolite enabled it almost appears as if bro does nothing. When I send a
test pcap with 30K packets bro is only able to proces 1800. The cpu usage of
bro never even gets passed 5%.

// Joel




On Tue, Mar 11, 2008 at 7:10 PM, Joel Ebrahimi <joel.ebrahimi at gmail.com>
wrote:

> I am running using Suse on PowerPC. I am also using specialty hardware
> from Bivio.
> I do not belive it is an issue with BPF.
>
>
> // Joel
>
>
>
> On Tue, Mar 11, 2008 at 5:21 PM, Vern Paxson <vern at icir.org> wrote:
>
> > What OS are you running under?  First immediate guess is that your
> > BPF buffers are much too small.
> >
> >                Vern
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20080311/3c689e41/attachment.html