[Bro] BroPing Connection Failure

[Fabian Hugelshofer]

Robin Sommer wrote:
> Before digging into this, what's the reason for compiling with
> --disable-select-loop? Seeing that the problem disappears without
> that switch, the problem likley lies somewhere in the alternative
> code path it enables. That code is rather old and rarely used these
> days, and I'm thinking it can actually be removed completely in
> future versions. So, what's your use case here?

I use it because without, Bro causes a high CPU usage, even if there 
isn't any traffic to analyse. That's about 30% CPU usage on a Pentium 4 
with 2.4 Ghz.

I read about using --disable-select-loop on 
http://bro-ids.org/wiki/index.php/User_Manual:_Performance_Tuning. There 
it sais that Phil Wood's libpcap is buggy in non-blocking mode. I'm 
using Phil's libpcap (0.9.8.20081128).

Fabian