# Run Bro with inspecting specific protocol only

**URL:** <https://community.zeek.org/t/run-bro-with-inspecting-specific-protocol-only/4645>\
**Category:** Zeek\
**Created:** [February 7, 2017, 1:16am UTC](https://community.zeek.org/t/run-bro-with-inspecting-specific-protocol-only/4645 "2017-02-07T01:16:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lincy\_Taylor](https://avatars.discourse-cdn.com/v4/letter/l/8e8cbc/32.png) [@Lincy\_Taylor](https://community.zeek.org/u/Lincy_Taylor)\
**Post date:** [February 7, 2017, 1:16am UTC](https://community.zeek.org/t/run-bro-with-inspecting-specific-protocol-only/4645/1 "2017-02-07T01:16:52Z")

</div>

Hello all:

How to run bro with only necessary module and specific protocol analyzers enabled? I am trying to use Bro to detect huge amount of malicious DNS queries and found the packet dropping rate is higher than 50% in bro with PF\_RING enabled. I was thinking if there’s any method to speed up Bro by disabling unnecessary modules and protocol analyzers. Another problem I am having is I implemented an event handler for ‘log\_dns’ event in my work and i will get no event logs if I removed the default built-in log stream of DNS with “Log::remove\_stream(DNS::LOG)”. Can anyone share with me your experiences? thanks.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/run-bro-with-inspecting-specific-protocol-only/4645/2 "2022-05-06T15:44:35Z")

</div>