Bro and myricom woes

Aha! Thanks, Seth.

I guess I need to think through this a bit.

Just curious, why does Bro break? Or what makes bro break?

Also, myricom needs to update some of their docs for v3 but all seems to still function just fine.

Cheers,
Harry

Just curious, why does Bro break? Or what makes bro break?

Bro does deep packet inspection and if the packets are artificially cropped and Bro can't see all of the traffic there ends up being a lot of missed bytes in connections. In order to correctly analyze many connections, all of the packet data needs to be there.

Also, myricom needs to update some of their docs for v3 but all seems to still function just fine.

They actually added a feature we requested. It should be possible to load balance traffic multiple times to multiple tools now. We still need to adapt our Myricom broctl plugin to support the way that works.

  .Seth