[Bro] Subject: 10Gbps Bro deployment

philosnef philosnef at yahoo.com
Sun Sep 11 12:24:13 PDT 2016


The problem with Bro is how resource intensive it is to run. On a 1Gb/s stream, you wouldnt need "much" (this is highly relative...). On a 10Gb/s, you really need to identify what your actual throughput is like. For us, our 4.5Gb/s sustained traffic needs ~400gigs of ram and 40 cores. :) About 1/3rd of that goes into cache, but the rest is resident.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160911/44e67d45/attachment.html 


More information about the Bro mailing list