Hi,
Im use bro 09a5 on fbsd v4.10r
Im runnning bro with statistics analyzer :
0.000000 Memory: total=7888K total_adj=0K malloced: 0K
0.000000 Run-time: user+sys=0.0 user=0.0 sys=0.0 real=0.0
0.000000 Conns: total=0 current=0/0 mem=0K avg=NaN table=0K connvals=0K
0.000000 Conns: tcp=0/0 udp=0/0 icmp=0/0
0.000000 TCP-States: Inact. Syn. SA Part. Est. Fin. Rst.
0.000000 TCP-States:Inact.
0.000000 TCP-States:Syn.
0.000000 TCP-States:SA
0.000000 TCP-States:Part.
0.000000 TCP-States:Est.
0.000000 TCP-States:Fin.
0.000000 TCP-States:Rst.
0.000000 Connections expired due to inactivity: 0
0.000000 Total reassembler data: 0K
0.000000 Timers: current=2 max=2 mem=0K lag=0.00s
0.000000 NetworkTimer = 1
0.000000 StatsTimer = 1
0.000000 Global_sizes > 100k: 0K
0.000000 Global_sizes total: 442K
and after two days,
1097426765.058420 Memory: total=93660K total_adj=85772K malloced: 0K
1097426765.058420 Run-time: user+sys=2688.9 user=2591.6 sys=97.3 real=202407.8
1097426765.058420 Conns: total=901762 current=3980/3980 mem=5783K avg=1488.0 table=6176K connvals=3886K
1097426765.058420 Conns: tcp=3980/5145 udp=0/3189 icmp=0/0
1097426765.058420 TCP-States: Inact. Syn. SA Part. Est. Fin. Rst.
1097426765.058420 TCP-States:Inact. 10 676 1
1097426765.058420 TCP-States:Syn.
1097426765.058420 TCP-States:SA
1097426765.058420 TCP-States:Part. 164
1097426765.058420 TCP-States:Est. 860 2019 1
1097426765.058420 TCP-States:Fin. 21 46 1
1097426765.058420 TCP-States:Rst. 135 46
1097426765.058420 Connections expired due to inactivity: 136238
1097426765.058420 Total reassembler data: 670K
1097426765.058420 Timers: current=0 max=9526 mem=172K lag=0.01s
1097426765.058420 Global_sizes > 100k: 0K
1097426765.058420 num_distinct_low_ports = 616K (4376 entries)
1097426765.058420 scan_triples = 280K (2 entries)
1097426765.058420 active_conn = 3877K (3608 entries)
1097426765.058420 num_distinct_ports = 661K (4848 entries)
1097426765.058420 distinct_ports = 520K (5532 entries)
1097426765.058420 distinct_low_ports = 449K (4434 entries)
1097426765.058420 HTTP::http_sessions = 38216K (32508 entries)
1097426765.058420 Global_sizes total: 45268K
Possible help me find why bro use 93660K ?
Im use bro with analyzer :
http-request
http-reply
dns
statistics
Regards