Gigabit link monitoring

Vern Paxson vern at
Tue Jul 25 12:41:28 PDT 2000

> Did somebody have information on the number of packets per second
> successfully processed by Bro?

It depends on how you want to cook the figure.  It runs routinely on a link
here with about 12,000 pps sustained, and peaks of 18,000 pps.  (Well, used
to; due to a topology change, the links I now routinely run it on have lower
rates.)  But it filters out a whole lot of the traffic.  The number quoted
in the revised Bro paper was one test showing it sustained 730 filtered
packets/sec sustained, with peaks of 1,200 pps, without drops (it's possible
it could have accommodated more, that was the highest-volume traffic stream
I had convenient).  This was measured in 1998 on what is now very modest
Intel hardware.  I haven't stressed tested it on higher streams, so don't
have a good upper figure.  Clearly, I should do that, in my copious spare
time ...


More information about the Bro mailing list