[Bro] Bro performance issues

Seth Hall seth at icir.org
Tue Nov 1 07:05:58 PDT 2011


On Nov 1, 2011, at 8:57 AM, Gregor Maier wrote:

> In terms of performance please note that using the new_packet() event 
> generates a lot of overhead so the performance you see is
> going to be significantly worse than in "normal" operation.


Oh, good point.  I should add something to the warnings file that prints out if you are handling that event to make sure people understand how badly it can impact performance.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list