[Bro] Network capture cards -- your experience

Jason Chambers jchambers at ucla.edu
Fri Sep 12 12:46:39 PDT 2008


Hello all,

I've read a number of research papers on using commodity hardware for
high speed network capture and I'd like to solicit real world feedback
on performance.

Endace products work great, however I'm interested to know of other
cards that prove to be worthwhile. 

If your running a custom built implementation that is processing >=
700Mbps on average then your the person I want to hear from.

Off-list replies are fine.  I'll summarize the results if people are
interested.

Thanks !

--Jason


Here are some metrics off the top of my head...


Card type (vendor, model, pci-e or pci-x)
    -

Card traffic is x or >= 700Mbps ?
    -

Device traffic is >= 1 Gbps (multiple 1 gig cards) ?
    -

Packets per second (average/max) ?
    -

Percentage of dropped traffic ?
    -

Operating system / device polling or MMAP used ?
    -

Processor type / number of cores ?
    -

Average CPU utilization ?
    -

Multiple applications connecting to the same pcap chain ?
    -





More information about the Bro mailing list