[Bro] Packet Drops

[Seth Hall]

On May 9, 2012, at 8:32 PM, Tom OBrion wrote:

> #fields	ts	ts_delta	peer	gaps	acks	percent_lost
> #types	time	interval	string	count	count	string
> 1336608708.135106	900.000206	bro	996	721708	0.138%
> 1336609608.135122	900.000016	bro	805	705801	0.114%


Now that actually looks really nice.  Did you say that you are running PF_Ring?  I trust the data from the NIC even less when using any of the various things that bypass the normal OS data flow (but I'm not saying that's a bad thing!).
  
  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/