[Bro] Large flows

[William Jones]

Woops!

-----Original Message-----
From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf Of William Jones
Sent: Monday, May 16, 2011 1:25 PM
To: bro at ICSI.Berkeley.EDU
Subject: [Bro] Large flows


I have a few machines that can produce large flows in access 100Mbytes over NLR.  This cause bro to drop packets.  Right now I am using pcap filters and extra workers on the sensor machine to insures that only packets dropped are from the file transfers machines.   This is not that big down side but it make we wonder if just what is the biggest flow that bro can handle on a single cpu.   








_______________________________________________
Bro mailing list
bro at bro-ids.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro