[Bro] Performance testing BRO
Robin Sommer
robin at icir.org
Fri Dec 15 11:52:01 PST 2006
On Thu, Dec 14, 2006 at 00:15 -0500, Randy Caldejon wrote:
> I'm curious to know if there is a standard suite of tests used to
> benchmark BRO? Our goal is to baseline BRO on commodity hardware
> then run the same tests on the accelerated platform. We have ideas
> on how to do this, but we're certainly open to suggestions --
> especially from those intimately familiar with BRO.
No, we don't have any performance benchmark. We did some performance
measurements in the past on traces (see
http://www.icir.org/robin/papers/ccs04.pdf), but I'd suppose that
you guys are more interested in live traffic.
In general, when doing measurements with Bro, it is important to
keep in mind that performance depends a *lot* on the actual
configuration. Bro internally applies various schemes to only
perform types of analysis which are actually required for the given
setup.
Robin
--
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org
LBNL/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro
mailing list