# Downside to using -b?

**URL:** <https://community.zeek.org/t/downside-to-using-b/2813>\
**Category:** Zeek\
**Created:** [September 13, 2013, 10:46pm UTC](https://community.zeek.org/t/downside-to-using-b/2813 "2013-09-13T22:46:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\
**Post date:** [September 13, 2013, 10:46pm UTC](https://community.zeek.org/t/downside-to-using-b/2813/1 "2013-09-13T22:46:43Z")

</div>

From what I can tell, not loading base/loading init-default.bro (using the -b option) significantly improves performance, particularly if you are not enabling a bunch of different kinds of analysis. Assuming my local.bro loads the base scripts it needs for processing, is there any reason why I wouldn’t use -b?

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [September 16, 2013, 1:56am UTC](https://community.zeek.org/t/downside-to-using-b/2813/2 "2013-09-16T01:56:21Z")

</div>

Hi Eric 🙂

There's no reason not to use -b if you actually don't want that stuff enabled. Generally speaking, the only thing that should be consuming processing time in the normal mode is the protocol analysis. Everything else feeds off of that so the rest of the code that gets loaded shouldn't actually be getting executed (for the most part).  
  
We made the decision to enable so many things by default for the 2.0 release because we wanted Bro to be extremely easy to run (to shed the past reputation of Bro being difficult to run). My goal to make it easier to run than tcpdump and I think we achieved that (bro -r packets.pcap). The -b option was our way to leave the door open for more enterprising users to truly customize things as they wanted while still making Bro do a lot by default.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\
**Post date:** [September 16, 2013, 1:53pm UTC](https://community.zeek.org/t/downside-to-using-b/2813/3 "2013-09-16T13:53:40Z")

</div>

Terrific, thanks!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/downside-to-using-b/2813/4 "2022-05-06T15:41:13Z")

</div>


