[Bro] Module execution

[Carl Rotenan]

Hello,

I'm looking to squeeze every bit of performance out of my Bro
implementation, and wanted to know:

1. Is there any over head that be turned off? I'm only looking to capture
HTTP, SMTP, and FTP, extract any files in transit, and calculate a SHA1
hash of those files.

2. Are there any tips for writing fast event code? Are there any known slow
moving operations?

3. Has anyone done any time execution analysis of their code and could
share the results?

Thank you as always,

Carl
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180509/b0e0bed1/attachment.html