[Bro] NIC recommends

Michał Purzyński michalpurzynski1 at gmail.com
Mon Jan 25 14:50:07 PST 2016


We have been running Bro sensors with multiple Myricom cards here, 10Gbit per sensor (it's the interface speed, not the actual traffic) with the Sniffer v3 software. Rock solid, with a few minor problems from time to time. Traffic is load balanced with the Arista switch in tap aggregator mode.





Sent from my iPhone
> On 25 Jan 2016, at 23:21, Brandon Glaze <bglaze at gmail.com> wrote:
> 
> James,
> I have had really good luck with the Netronome NFE-3240 NIC's. I have only run them to 20Gbps each. Their NFP-6xxx series have multiple 100Gb or 40Gb interfaces, and their support is awesome (they helped me build my Bro servers initially).
> 
> The Berkeley Lab 100Gb bro sensors (search for 100GIntrusionDetection) used Myricom 10GPCIE28C22+ cards, and their PDF has all the configs (plus its a great practical research and proof of concept paper). I am sure Myricom has 40Gb cards, but you would have to research it.
> 
> =====================
> Brandon Glaze
> bglaze at gmail.com
> 
> "Lead me, follow me, or get the hell out of my way." 
> - General George Patton Jr
> 
> 
> 
>> On Mon, Jan 25, 2016 at 1:39 PM, James Lay <jlay at slave-tothe-box.net> wrote:
>> Hey All,
>> 
>> Topic says it....sizing up for capturing LAN traffic...thinking a 40 or
>> even 100 gig nic.  This would be a single machine doing nothing else but
>> bro.  Thanks for any assistance.
>> 
>> James
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160125/1a568040/attachment.html 


More information about the Bro mailing list