[Bro] optimize running bro from PCAPs / advantage of cluster mode

[Mike Dopheide]

> My original question still stands: Are there any parsers which combine
> the information seen by different workers in different flows?
>

Policies yes, parsers I'm not sure, but I don't believe so.

-Dop
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170929/ee8fb7aa/attachment.html