[Bro] Bro 2.0 packets dropped

[William Jones]

Are you using pf_ring?

-----Original Message-----
From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf Of Machiel van Veen
Sent: Friday, February 03, 2012 7:38 AM
To: bro at bro-ids.org
Subject: [Bro] Bro 2.0 packets dropped

Hello,

I am getting a lot of messages reporting dropped packages. This is on CentOS 
6.2 running 3 workers on a quad core machine with 8 gb of ram, sas disks. 

The link I monitor has low traffic, 0.2 k packets p/s avg, max 2.0 k peaks, 
the server load is very low. I would expect no packets to be dropped. 

Besides tuning the receive buffer and queue length is there anything else I 
can do about this?

worker-1: 1328274953.996680 recvd=129059158 dropped=114860 link=129174018
worker-2: 1328274954.197859 recvd=129059218 dropped=115120 link=129174338
worker-3: 1328274954.397642 recvd=129052866 dropped=122170 link=129175036

Thank you, Machiel.
_______________________________________________
Bro mailing list
bro at bro-ids.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro