Arne Welzel 7fac5837c3 iosource/pcap: Support configurable buffer size ... On Linux with a default ext4 or tmpfs filesystem, the default buffer size for reading a pcap is chosen as 4k (strace/gdb validated). When reading large pcaps containing raw data transfers, the syscall overhead for read becomes visible in profiles. Support configurability of the buffer size and default to 128kb. When processing a ~830M PCAP (16 UDP connections, each transferring ~50MB) in bare mode, this change improves runtime from 1.39 sec to 1.29 sec. Increasing the buffer further didn't provide a noticeable boost.		2023-10-10 15:08:51 +02:00
..
dumper.zeek	Separate stdout from stderr in btest baselines	2021-03-30 16:23:23 -07:00
dynamic-filter.zeek	Remove @load base/frameworks/dpd from tests	2022-08-31 17:00:55 +02:00
filter-error.zeek	updates for gen-C++ maintenance, including skipping some inappropriate tests	2022-08-01 16:47:17 -07:00
filter-warning.zeek	Add btest that exercises the pcap filter warnings	2022-10-21 10:50:00 -07:00
input-error.zeek	annotated scripts to skip when testing compilation-to-C++	2022-09-16 16:47:43 -07:00
pseudo-realtime.zeek	General btest cleanup	2020-08-11 11:26:22 -07:00
read-trace-with-filter.zeek	GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.	2019-05-01 21:43:45 +00:00
wrong-format.zeek	iosource/pcap: Support configurable buffer size	2023-10-10 15:08:51 +02:00