[Bro] Downside to using -b?

[Seth Hall]

On Sep 13, 2013, at 6:46 PM, "Thomas, Eric D" <edthoma at sandia.gov> wrote:
> 
> From what I can tell, not loading base/loading init-default.bro (using the -b option) significantly improves performance, particularly if you are not enabling a bunch of different kinds of analysis. Assuming my local.bro loads the base scripts it needs for processing, is there any reason why I wouldn't use -b?

Hi Eric :)

There's no reason not to use -b if you actually don't want that stuff enabled.  Generally speaking, the only thing that should be consuming processing time in the normal mode is the protocol analysis.  Everything else feeds off of that so the rest of the code that gets loaded shouldn't actually be getting executed (for the most part).

We made the decision to enable so many things by default for the 2.0 release because we wanted Bro to be extremely easy to run (to shed the past reputation of Bro being difficult to run).  My goal to make it easier to run than tcpdump and I think we achieved that (bro -r packets.pcap).  The -b option was our way to leave the door open for more enterprising users to truly customize things as they wanted while still making Bro do a lot by default.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130915/d7799e21/attachment.bin