[Bro] Module execution

[Carl Rotenan]

I’m trying to get as close as I can to supporting 10Gbs. I’ve been running
upwards of 18 workers supporting 1 10G Intel NIC. As I increase network
traffic I’m getting packet loss, and want to explore the code as a
bottleneck.

On Wed, May 9, 2018 at 7:29 PM Zeolla at GMail.com <zeolla at gmail.com> wrote:

> Are you optimizing for a specific piece of hardware?  Knowing any
> constraints there will be helpful as there are some changes that can be
> made based off of the hardware setup or traffic composition/speeds.
>
> Jon
>
> On Wed, May 9, 2018, 18:21 Carl Rotenan <carlrotenan at gmail.com> wrote:
>
>> Hello,
>>
>> I'm looking to squeeze every bit of performance out of my Bro
>> implementation, and wanted to know:
>>
>> 1. Is there any over head that be turned off? I'm only looking to capture
>> HTTP, SMTP, and FTP, extract any files in transit, and calculate a SHA1
>> hash of those files.
>>
>> 2. Are there any tips for writing fast event code? Are there any known
>> slow moving operations?
>>
>> 3. Has anyone done any time execution analysis of their code and could
>> share the results?
>>
>> Thank you as always,
>>
>> Carl
>>
> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
> --
>
> Jon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180510/12ae6442/attachment.html