[Bro] BroPing Connection Failure

Fabian Hugelshofer fh at open.ch
Fri Nov 20 06:07:41 PST 2009


Seth Hall wrote:
> On Nov 20, 2009, at 7:29 AM, Fabian Hugelshofer wrote:
> 
>> Is there a way of reducing the negative effects from Seth's patch? It's
>> a bit irritating that the CPU usage for the parent increases. I wouldn't
>> have expected that.
> 
> 
> What scripts are you loading?  Any custom ones?  I'd like to attempt to 
> replicate the effects you're seeing.

Before I showed you the results from my custom scripts. To exclude any 
unnecessary influence, I let it run again: on the loopback device and 
just with broping.bro:

src/bro -i lo -C aux/broccoli/test/broping.bro

The results:
noloop     13.26
default    89.68
patch      77.14
pcap       32.7
pcap+patch 50.2
1.5        87.45

The regression of the patch is visible with the default version of 
libpcap, but not with Phil Wood's. Not sure wether I had a calculation 
error there before (dnt have the resutls from the first run anymore).

Fabian



More information about the Bro mailing list