How large can the Intel file .dat be?

Zeek
1

Hello Zeek Community,

I am doing some researches to Zeek.

Maybe one of you can help me with that question. How large can the intel file (intel-1.dat from try.zeek.org) can be?

I’m asking that question because if you fill that file with tons of IP’s/domains , there should be some performance issues with the large incoming IP’S and matching these to the list.

I hope somebody can help me.

Thank you for your time and I am looking forward to hearing from you

Best Regards,

Jens

Mit freundlichen Grüßen,
Best Regards,
Jens Rembe

Privileged & Confidential—Attorney-Client Communication—Prepared at the Request of Counsel, Vertrauliche Verteidigerkorrespondenz.

image001.gif

2

Hi,

I don’t use try.bro.org but in real-life, my intel files have about 10,000 entries. They used to be much bigger but some of that intel wasn’t good enough to keep using. L The files reload every hour. I’ve seen no performance hit based on their size but I do have big physical servers only handling about 5-6 GB/sec.

Pat

image001.gif