zeek performance with some events activated
Palumbo Mauro <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hi Zeek-devs,
I need to do some analysis on TCP flags and the event "tcp_packet" perfectly fits my needs. However, as stated in Zeek's documentation, using this event may significantly affect Zeek's performance, given the high number of TCP packets to look into.
Is there any other way to look into TCP flags? Would bypassing scriptland and modifyng directly the C++ code be more efficient (though not the "proper" way to do it)?
Thanks in advance,
Mauro
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek