[Bro] connecting to bro with broccoli

Seth Hall seth at icir.org
Sun Aug 31 09:13:21 PDT 2014


On Aug 27, 2014, at 1:29 PM, daniel nagar <dngr7512 at gmail.com> wrote:

> I'm using bro 2.2 and I connect to bro using broccoli to receive events.
> I can manage connecting to bro-worker and receive events, not sure if it's the correct way to receive event from bro but connecting to the manager port didn't retrieve any event whatsoever,

Could you give more information about what events you are sending around?  Are you receiving events from Bro or sending them to Bro?  

What configuration have you done in Bro to send or receive these events?

> the problem is that when I receive events at speeds higher than 2Mbps the parent of the bro-worker (not the broccoli application) memory expands rapidly and can reach 10Gb in a minute.

Another interesting number might be events per second.  I'm even a little unclear what you mean by 2Mbps.  Do you mean that the data rate of your connection between your broccoli application and Bro is 2Mbps?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140831/db35bbfc/attachment.bin 


More information about the Bro mailing list