On Fri, Apr 07, 2006 at 16:52 -0600, Stephen J. Smoogen wrote:
Whatever floats your boat is my general opinion. I
worked for Red Hat
for many years so have a bias towards it.. but I know that the Bro
code seems optimized for FreeBSD.
Bro itself is not really optimized for FreeBSD. Much of its
development happened to take place on FreeBSD but there's hardly any
BSD-specific in it.
Still, in our experience the capture performance of FreeBSD is much
better than that of Linux, at least w/o further Linux kernel patches
(which sometimes show other problems, e.g., not working correctly
with non-blocking the pcap calls used by Bro).
Robin Sommer * Phone +1 (510) 666-2886 * robin(a)icir.org
ICIR/ICSI * Fax +1 (510) 666-2956 * www.icir.org