[Bro] Bro performance issues
Seth Hall
seth at icir.org
Tue Nov 1 07:05:58 PDT 2011
On Nov 1, 2011, at 8:57 AM, Gregor Maier wrote:
> In terms of performance please note that using the new_packet() event
> generates a lot of overhead so the performance you see is
> going to be significantly worse than in "normal" operation.
Oh, good point. I should add something to the warnings file that prints out if you are handling that event to make sure people understand how badly it can impact performance.
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/
More information about the Bro
mailing list