# Enable DPD per default in 1.6? **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [January 24, 2011, 8:32pm UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803 "2011-01-24T20:32:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 24, 2011, 8:32pm UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803/1 "2011-01-24T20:32:25Z")
I'm wondering whether we should turn on DPD by default in 1.6. Doing so would involve two things:     (1) Loading the DPD signatures (i.e., dpd.bro)     (2) Setting the packet filter to include all packets. The former shouldn't be a problem, but the latter would be a major change. We'd still keep the current build-your-filter-dynamically scheme, but it would have to be enabled explicity (say, with an option in pcap.bro). There's a further advantage to doing (2): it would eliminate one of the most common mistakes: not realizing that Bro's filter doesn't include what one wants to analyze. With a default-all filter, Bro does what one would intuitively expect, and changing the filter to be more restrictive could be filed under "performance tuning". Thoughts? Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [January 24, 2011, 8:50pm UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803/2 "2011-01-24T20:50:42Z")
I like the idea. The common case seems to have become running with DPD enabled anyway. It would be one less thing for most people to have to configure as soon as they do the install. All as long as the filtering system gets some documentation. 🙂   .Seth ---
**Author:** ![Adam\_J\_Slagell](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Adam\_J\_Slagell](https://community.zeek.org/u/Adam_J_Slagell)\ **Post date:** [January 24, 2011, 8:53pm UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803/3 "2011-01-24T20:53:58Z")
Definitely a change to highlight in the INSTALL file and the FAQ page on the web. I imagine some people will be wondering why it slowed down for them on a 1.6 update because of that change. If this change isn't very clear, then they could just give up on 1.6. ---
**Author:** ![Tyler\_Schoenke](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tyler\_Schoenke](https://community.zeek.org/u/Tyler_Schoenke)\ **Post date:** [January 24, 2011, 9:59pm UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803/4 "2011-01-24T21:59:52Z")
I agree with the change. My performance issues seemed to be related to how many alerts were firing. Once I turned off many of the alerts, the cluster was more stable. I played with turning the dpd.bro off, and didn't notice much performance improvement. I also didn't notice much of a performance change when the packet filter was set to the default set or all packets. I think most people will have performance issues with the volume of traffic they are processing. I was estimating 32 cores would be needed to handle 1 Gbps comfortably. Our 8 cores are dropping typically around 5-20% of the traffic, while processing 580 Mbps. Using Click! was critical to getting the cluster processing at a decent rate. Turning off some of the less-needed alerts might help offset enabling DPD. Tyler ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [January 25, 2011, 2:21am UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803/5 "2011-01-25T02:21:43Z")
Hm, that doesn't mesh with my experience. I would expect 8 cores to be able to deal with 580 Mbps pretty comfortably. I'll follow up with you offlist.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/enable-dpd-per-default-in-1-6/1803/6 "2022-05-06T15:39:26Z")