# issue with bro size

**URL:** <https://community.zeek.org/t/issue-with-bro-size/4071>\
**Category:** Zeek\
**Created:** [March 25, 2016, 9:31am UTC](https://community.zeek.org/t/issue-with-bro-size/4071 "2016-03-25T09:31:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cyrille\_PIATTE](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@Cyrille\_PIATTE](https://community.zeek.org/u/Cyrille_PIATTE)\
**Post date:** [March 25, 2016, 9:31am UTC](https://community.zeek.org/t/issue-with-bro-size/4071/1 "2016-03-25T09:31:38Z")

</div>

Hello,

I am a new user of Bro and I have some questions:

I have read that in the next version of Bro, the BroKer communication system will be included in the installation.  
-When is the next release of Bro ? Will Broccoli be deleted ?

When I install Bro with the option ./configure --enable-broker, my Bro directory is about 1.5Gb. Otherwise, it is about 180Mb. At the same time, the binary is about the same size (145Mb).  
-Why such a difference ?

Moreover, when I use all the other --disabled options, the difference is not that important (about 200Mb).  
-Is it normal ? Are there any other options that would allow us to reduce the size of the program ? We plan to use Bro on constrained devices with the BroKer library.

I have found some documentation about Broccoli security options. But I have not found any documentation regarding BroKer security options.  
-Does it use also SSL ? In which communications ? Are there some differences with Broccoli concerning security ? Could we find documentation about security protocols used by BroKer communications ?

I thank you in advance for your support.

Best regards,

Cyrille Piatte

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [March 25, 2016, 2:48pm UTC](https://community.zeek.org/t/issue-with-bro-size/4071/2 "2016-03-25T14:48:18Z")

</div>

> I am a new user of Bro and I have some questions:

Welcome aboard!

> I have read that in the next version of Bro, the BroKer communication  
> system will be included in the installation.  
> -When is the next release of Bro ? Will Broccoli be deleted ?

The next release of Bro, version 2.5, is contingent on a stable running  
integration with Broker. We will also deprecate Broccoli as soon as we  
make Broker the default communication component.

> When I install Bro with the option ./configure --enable-broker, my Bro  
> directory is about 1.5Gb. Otherwise, it is about 180Mb. At the same  
> time, the binary is about the same size (145Mb).  
> -Why such a difference ?

Can you give us more detail what files contribute to the increase in  
size? What happens when you remove debugging symbols (i.e., remove the  
-g switch from the compilation process)? Note that debugging symbols do  
not have any runtime overhead during execution.

> Moreover, when I use all the other --disabled options, the difference  
> is not that important (about 200Mb). -Is it normal ? Are there any  
> other options that would allow us to reduce the size of the program ?  
> We plan to use Bro on constrained devices with the BroKer library.

My hunch is that Broker (and in particular CAF) generates huge symbol  
tables, due to the excessive amount of C++ template code and insane name  
mangling.

> I have found some documentation about Broccoli security options. But I  
> have not found any documentation regarding BroKer security options.  
> -Does it use also SSL ? In which communications ? Are there some  
> differences with Broccoli concerning security ? Could we find  
> documentation about security protocols used by BroKer communications ?

At this point Broker does not support encryption, but it's on our TODO  
list. Once the underlying communication library CAF supports encryption,  
it will be rather simple to simple to lift it into Broker. We hope that  
TLS support will make it into the next release, but it's not clear at  
this point.

&nbsp;&nbsp;&nbsp;&nbsp;Matthias

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/issue-with-bro-size/4071/3 "2022-05-06T15:43:31Z")

</div>


