[Bro] Question on PacketFilter::DroppedPackets

Johanna Amann johanna at icir.org
Fri Mar 3 15:20:03 PST 2017


On Thu, Feb 16, 2017 at 02:05:19PM -0500, Espresso Beanies wrote:
> Hi,
> 
> It seems no matter what I do, I still get these notices
> "PacketFilter::DroppedPackets". I created more workers, but I have a
> question about creating new workers via using an existing worker to capture
> on the same interface using the "lb_procs" method to up the number of
> "sub-threads?" for multi-CPU processing. What advantage does a new worker
> give me over "lb_procs"?

It is the same, lb_procs also basically just creates new workers; the
advantage is that it does things automatically for you that you would have
to configure by hand otherwhise.

Johanna


More information about the Bro mailing list