[Bro] [Not] Running Bro as root?

Drew Dixon dwdixon at umich.edu
Wed Jun 13 15:39:49 PDT 2018


Thanks everyone for the input on this, it's been very helpful, and I think
seems to be resulting in some positive things.  I received some great info
from folks both on and off list.

Side note:  Apologies for unintentionally hijacking the subject line
marker, I probably should have used parenthesis instead of brackets....  :
)

-Drew

On Wed, Jun 13, 2018 at 2:56 PM Azoff, Justin S <jazoff at illinois.edu> wrote:

>
> > On Jun 13, 2018, at 5:41 PM, Michał Purzyński <
> michalpurzynski1 at gmail.com> wrote:
> >
> > And to your second point - yes, bro documentation needs some
> improvements when it comes to the afpacket.
>
> Agreed.  I put together some of what we have now for starting up a bro
> cluster using pf_ring since that used to be the only generic option.
>
> Now that af_packet is working almost everywhere I want to add a section to
> the docs for that.  The bro side of things is actually really simple,
> most of the effort goes into validating that af_packet is hashing things
> properly.
>
>
>> Justin Azoff
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180613/5069c9e1/attachment.html 


More information about the Bro mailing list