[Bro] About Bro Processing Speed

Vlad Grigorescu vladg at cmu.edu
Tue Mar 19 11:35:10 PDT 2013


Just to throw another data point out there:

> * 16 physical cores of model name	: Intel(R) Xeon(R) CPU E5-2680 @ 2.70 GHz
> * 96GB of RAM
> * Myricom NIC

28 workers (I have Hyperthreading turned on) keep up with a 6-7 Gbps average, and I've seen them do fine with short peaks of 9 Gbps or so. The Myricom cards definitely won't break the bank: card + SR optics + perpetual license is $895.

  --Vlad

On Mar 19, 2013, at 2:20 PM, Mike Patterson <mike.patterson at uwaterloo.ca>
 wrote:

> "It depends."
> 
> On - hardware, mostly, and configuration.
> 
> I keep meaning to write this up, but on *my* configuration:
> * 16 cores of model name	: Intel(R) Xeon(R) CPU           X5677  @ 3.47GHz
> * 72GB of RAM
> * Endace DAG (9.2)
> * some config magic by Seth, which I'd be happy to share.
> 
> 6 workers keep up with ~2.5-3Gbps peaks, no problem. 
> 
> On lesser hardware, your mileage will definitely vary. The secret sauce appears to be the DAG. Hot CPUs doesn't hurt either. :) You'll probably find that an Endace will cost as much as the server you'd put it in. I think it's worthwhile, but your budget is yours.
> 
> It doesn't actually consume all of the above resources - I'm running other things on the box too - but bro itself consumes ~4.5GB resident per worker, and can be counted on to pin most of its allocated cores at peak loads.
> 
> Mike
> 
> On 2013-03-19, at 1:49 PM, keqhe at cs.wisc.edu wrote:
> 
>> 
>> Hello,
>> 
>> Does any one know Bro's processing speed? i.e., can it support monitoring
>> 1 Gbps or 10Gbps link?
>> 
>> Thanks!
>> 
>> 
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro





More information about the Bro mailing list