Arne Welzel

Seems to be fixed when running locally here. I've added the PR (https://github.com/zeek/zeek/pull/2478) to the 5.0.4 candidates.

> * After all intel items have been produced, the manager process runs at ~110% (fully utilized caf.thread) for ~110sec until CPU usage goes to normal. And there's another twist:...

The following change in `caf` to switch to `std::deque` reduces the time reported above for current master from ~110sec to a bit under 30 seconds. Manger CPU usage after intel...

Hey @Neverlord - I've finally looked again. I took latest master and included the caf fix, compiled without ASAN and -O3. * With 16 workers, it takes ~30seconds for the...

Thanks for the comments. > Would it be easy for you to change the types and generate new performance data? Having data on whether or not it's worth it to...

The branch unfortunately doesn't compile for me. Here's a test script though - it creates two tables each with 500k entries and publishes them to a connecting worker from the...

> Should I go ahead and make the changes on the branch for testing purposes or is that a deal breaker right away? No real opinion. I don't have hunch...

Hello @iyuvalk - the pcaps in the google drive folder are both the same, neither using source port 53. Could you verify and re-upload a pcap with the suspected issue?...

Hmm, so I used the `nmap` command from your initial message against a proftpd server within a container. The `--source-port 53` option didn't have much of an effect (only a...

Hello @iyuvalk - I'm going to close this issue. Feel free to re-open if the above two comments aren't sufficient or you have a pcap reproducing the issue you initially...