# Bro Question **URL:** \ **Category:** Zeek\ **Created:** [February 4, 2000, 7:07am UTC](https://community.zeek.org/t/bro-question/71 "2000-02-04T07:07:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [February 4, 2000, 7:07am UTC](https://community.zeek.org/t/bro-question/71/1 "2000-02-04T07:07:49Z")
> I am a student a Harvey Mudd College and I am working with a research > clinic sponsored by the Aerospace Corporation. I'm currently > working on configuring Bro alpha 0.6 under Solaris 2.7. When I start > running it, it appears to be working for a while, but eventually > (sometime between 25min and about a day) it runs away, takes up the whole > cpu on an Ultra Sparc 30 with 256 megs of RAM, and never seems to write > to any of its logs again. What volume traffic stream are you running it on, and with what tcpdump filter? The symptoms sound like it is running out of virtual memory and starting to page-fault thrash.     Vern ---
**Author:** ![Matt\_Schnaider](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Matt\_Schnaider](https://community.zeek.org/u/Matt_Schnaider)\ **Post date:** [February 4, 2000, 9:36am UTC](https://community.zeek.org/t/bro-question/71/2 "2000-02-04T09:36:57Z")
I'm using the suggested filter, i.e.: ./bro -f "((tcp[13] & 0x7 != 0) or \ port telnet or tcp port 513 or port finger or port 111 or tcp port 113 or \ port ftp or dst port 8000 or \ (tcp and (ip[6:2] & 0x3fff != 0)))" \ -i hme0 mt Looking at the top stats for the system, top gives: load averages: 1.00, 1.01, 1.01 00:15:11 22 processes: 20 sleeping, 1 running, 1 on cpu CPU states: 0.0% idle, 99.8% user, 0.2% kernel, 0.0% iowait, 0.0% swap Memory: 256M real, 76M free, 13M swap in use, 424M swap free   PID USERNAME THR PRI NICE SIZE RES STATE TIME CPU COMMAND 3172 root 1 40 0 4216K 3736K run 22.9H 99.51% bro 3197 root 1 58 0 2152K 1488K cpu 14:05 0.25% top   193 root 1 58 0 1872K 864K sleep 2:45 0.00% sshd1     1 root 1 59 0 2232K 696K sleep 0:06 0.00% init etc... tcpdump is seeing between 250 and 2500 packets per second with no filter depending on the time of day. With the suggested filter, its see about 1-100 packets per second. -Matt \_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_ Matthew J. Schnaider East 121 Harvey Mudd College x72006 340 E. Foothill Blvd. Class of 2001 Claremont, CA 91711 Computer Science Department Staff "For starters, what is an echo and what does it do? The echo program reads a string and repeats it; think of the program as an automated liberal arts undergraduate student."         -- Stephen Northcutt \_Network Intrusion: An Analyst's Handbook\_ .\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_.\_. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/bro-question/71/3 "2022-05-06T15:36:08Z")