[Bro] Bro plugins: Any best practices for the number of plugins on an instance?

[Johanna Amann]

On Wed, Jun 27, 2018 at 02:44:42PM +0000, Azoff, Justin S wrote:
> When you say plugins, what exactly are you referring to?

Just to expand on this a bit - I assume that you are refering to Bro
packages in the package manager.

In this case, there is no clear answer - the packages do vastly different
things with vastly different complexity. If you have a package that adds a
small script that is rarely called, or does a not-expensive operation -
you probably have no problems even loading tens (or hundreds) of them, as
long as they don't conflict.

If the package that you are loading does some expensive
per-packet-processing, even a single one might be too much.

So, the answer is probably - as so often - it depends :)
 Johanna