[Bro] CPU usage with no traffic on Bro 2.5 with AF_PACKET

Ed Sealing ed.sealing at sealingtech.org
Sat Dec 17 09:02:49 PST 2016


I'm seeing ~6% CPU utilization on workers, with no traffic. Is that
expected? Is there any way to minimize the CPU load?

Using AF_PACKET plugin. The cores are isolated using "isolcpus", so nothing
else should be running on them. Workers are pinned to the CPUs in the

[worker-1]
type=worker
host=localhost
interface=af_packet::eth1
lb_method=custom
lb_procs=14
pin_cpus=1,2,3,4,5,6,7,9,10,11,12,13,14,15


~Ed
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161217/ee43567d/attachment.html 


More information about the Bro mailing list