[Bro] Experiences with Bro and FreeBSD 8.2 Zerocopy BPF

[Jim Mellander]

We tried configuring with and without the select loop option, as well as
quite a bit of custom hacking.  I'm wondering if there is something that
broccoli does that tinkers with socket settings that affects in some weird
way the bpf socket.

At some point in the next couple of weeks I'm gonna pick this up again.

On Wed, May 4, 2011 at 7:45 AM, Robin Sommer <robin at icir.org> wrote:

>
> On Tue, May 03, 2011 at 16:40 -0700, you wrote:
>
> > like us, as they go forward in this direction.  If anyone has any
> > suggestions, etc. (particularly in going forward with solving this
> problem),
> > I would appreciate it.
>
> Just a quick thought: you could see if configuring with
> --disable-select-loop makes a difference. That changes the pcap code
> in Bro a bit (on FreeBSD actually not that much, but still worth a
> try).
>
> If it did help, not sure what that would mean though: we have just
> ripped out the alternative code path for Bro 1.6 ...
>
> Robin
>
> --
> Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
> ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20110504/06f48e09/attachment.html