[Bro] Network capture cards -- your experience
jchambers at ucla.edu
Fri Sep 12 12:46:39 PDT 2008
I've read a number of research papers on using commodity hardware for
high speed network capture and I'd like to solicit real world feedback
Endace products work great, however I'm interested to know of other
cards that prove to be worthwhile.
If your running a custom built implementation that is processing >=
700Mbps on average then your the person I want to hear from.
Off-list replies are fine. I'll summarize the results if people are
Here are some metrics off the top of my head...
Card type (vendor, model, pci-e or pci-x)
Card traffic is x or >= 700Mbps ?
Device traffic is >= 1 Gbps (multiple 1 gig cards) ?
Packets per second (average/max) ?
Percentage of dropped traffic ?
Operating system / device polling or MMAP used ?
Processor type / number of cores ?
Average CPU utilization ?
Multiple applications connecting to the same pcap chain ?
More information about the Bro