Custom event handler script generates heavy CPU load with Bro 2.5.5 (PF_RING)

Zeek
1

Hello. I have a script which defines a custom handler on mime_data event:

event mime_all_data (c: connection, length: count, data: string)

{

// do stuff

}

When this script is ran with capturing traffic in PF_RING mode using lb_procs=2, Bro processes consume 100% of both pinned CPU cores. This is not the case when capturing without PF_RING in single process mode though. What are possible reasons for this? Can it be optimized on the script side? What can be done to lower the CPU usage?

2

Hi Elena,

I think you're conflating two potential problems.

  - Is handling the mime_all_data event causing overload?
  - Is PF_Ring working correctly?

If you take your script out of the picture are you still seeing 100% cpu utilization?

   .Seth