[Bro] Bro performance issues

Tomer Teller djteller at gmail.com
Mon Oct 31 05:52:08 PDT 2011


I am using version 1.5.3

Running on 2 x Intel Xeon  2.33GHz with 4GB *FBDIMM and *8 Cores

For now I just want to test that 2 cores.

This is my node.cfg

[manager]
type=manager
host=localhost

[proxy-1]
type=proxy
host=localhost

[worker-1]
type=worker
host=localhost
interface=bg0

[worker-2]
type=worker
host=localhost
interface=bg0

I want to load balance my traffic between 2 cores using the
mentioned restrict filter (due to NAT, maybe it will be wise to filter by
Source port, even -> worker-1, odd -> worker-2)

On Mon, Oct 31, 2011 at 2:35 PM, Seth Hall <seth at icir.org> wrote:

>
> On Oct 31, 2011, at 6:45 AM, Tomer Teller wrote:
>
> > All the packets are valid IPv4, I just noticed that my CPU goes to 92%
> so I am probably suffering drops due to load.
>
> Very likely.  I usually try not to send more than 80-100Mbps of traffic to
> a single core.
>
> > How do I load worker-1 with 'worker1-policy.bro' and worker-2 with
> 'worker2-policy.bro' ? The documentation only talks about
> 'local-worker.bro' that is being loaded by all the workers.
>
> What version are you using?  1.5.x or the 2.0 beta we just released on
> friday?  The answers to all of your questions will be different based on
> it. :)
>
>  .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro-ids.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20111031/7a2845c4/attachment.html 


More information about the Bro mailing list