[Bro] BRO 2.0 - SMTP - Saving file attachments causing many packet Drops

[Seth Hall]

On Nov 29, 2011, at 9:55 AM, John Merit wrote:

> I am testing the SMTP write file to disk feature (entities.bro) which also works great on file attachments.

Glad to hear that's working for you.

> Am i doing something wrong? is there anyway to optimize it even better to get rid of the drops?

If you are using broctl, in your broctl.cfg file add the line (then install and restart in broctl)…
broargs = -l 9800

We have been seeing problems with the beta in some cases with packet loss at fairly low packet load which we are planning to address for the final release but reducing the snap length has typically been fixing it for people.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20111129/e856f62f/attachment.bin