[Zeek] First attempt to upgrade to 3: Multiple interfaces

Justin Azoff justin at corelight.com
Tue Mar 3 18:50:05 PST 2020


On Tue, Mar 3, 2020 at 9:39 PM Michał Purzyński <michalpurzynski1 at gmail.com>
wrote:

> From what you’re describing, you’re running Zeek on a resource constraints
> device.
>
> You might want to actually use the newest version - not sure where Justin
> fixes for the packet processing loop went in, but they should help a lot.
>

Oh hah, I don't need any credit for all of that work.  I had an old patch
against 2.4/5/6 that would relax the polling loop interval so it wouldn't
eat up a lot of cpu on smaller devices, but it wasn't a fix.  Tim
completely rewrote the IO loop so now zeek on a raspberry pi should use 0%
cpu when there's no traffic.

-- 
Justin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200303/4d139aeb/attachment.html 


More information about the Zeek mailing list