Question on PacketFilter::DroppedPackets

Zeek
1

Hi,

It seems no matter what I do, I still get these notices “PacketFilter::DroppedPackets”. I created more workers, but I have a question about creating new workers via using an existing worker to capture on the same interface using the “lb_procs” method to up the number of “sub-threads?” for multi-CPU processing. What advantage does a new worker give me over “lb_procs”?

Thanks!

2

It is the same, lb_procs also basically just creates new workers; the
advantage is that it does things automatically for you that you would have
to configure by hand otherwhise.

Johanna

3

Hi Johanna,

Thanks for the clarification. I wasn’t sure if one method had an advantage over another.