[Bro] Bro performance issues

[Seth Hall]

On Oct 31, 2011, at 6:45 AM, Tomer Teller wrote:

> All the packets are valid IPv4, I just noticed that my CPU goes to 92% so I am probably suffering drops due to load.

Very likely.  I usually try not to send more than 80-100Mbps of traffic to a single core.

> How do I load worker-1 with 'worker1-policy.bro' and worker-2 with 'worker2-policy.bro' ? The documentation only talks about 'local-worker.bro' that is being loaded by all the workers.

What version are you using?  1.5.x or the 2.0 beta we just released on friday?  The answers to all of your questions will be different based on it. :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/