[Bro] Performance testing BRO

Robin Sommer robin at icir.org
Fri Dec 15 11:52:01 PST 2006

On Thu, Dec 14, 2006 at 00:15 -0500, Randy Caldejon wrote:

> I'm curious to know if there is a standard suite of tests used to  
> benchmark BRO?  Our goal is to baseline BRO on commodity hardware  
> then run the same tests on the accelerated platform.  We have ideas  
> on how to do this, but we're certainly open to suggestions --  
> especially from those intimately familiar with BRO.

No, we don't have any performance benchmark. We did some performance
measurements in the past on traces (see
http://www.icir.org/robin/papers/ccs04.pdf), but I'd suppose that
you guys are more interested in live traffic.

In general, when doing measurements with Bro, it is important to
keep in mind that performance depends a *lot* on the actual
configuration. Bro internally applies various schemes to only
perform types of analysis which are actually required for the given


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list