[Bro] Multi-Thread bro with pcap file?

[Seth Hall]

> On Apr 15, 2015, at 11:05 AM, Joe Blow <blackhole.em at gmail.com> wrote:
> 
> Can this only be done with one thread?

Alex and Luuk gave answers that will work, but I wanted to throw one more that is coming into the mix too.  Eventually you should be able to use PacketBricks (https://github.com/bro/packet-bricks) to read in pcap files and distribute the traffic out to multiple workers. (just wanted to point out another direction we’re moving).

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/