[Bro] incoming traffic

Vern Paxson vern at icir.org
Wed Mar 14 20:12:08 PDT 2007

> Just wondering if there is a known incoming speed limit at which Bro 
> will perform to its best? I refer to the traffic speed (100Mbps ?)

This isn't really a well-formed question: too much depends on the specifics
of your traffic mix, the sorts of analysis you want to perform, and your
hardware platform.  We use Bro operationally at LBL and NERSC to monitor
10 Gbps links using commodity PCs.  However, monitoring UC Berkeley's
traffic (slower links, technically, but much busier anyway) requires the
user of a clusterized Bro.

That said, if 100 Mbps is the speed you wish to monitor, that should
certainly be doable.


More information about the Bro mailing list