[Bro] About Bro Processing Speed

[Mike Patterson]

"It depends."

On - hardware, mostly, and configuration.

I keep meaning to write this up, but on *my* configuration:
* 16 cores of model name	: Intel(R) Xeon(R) CPU           X5677  @ 3.47GHz
* 72GB of RAM
* Endace DAG (9.2)
* some config magic by Seth, which I'd be happy to share.

6 workers keep up with ~2.5-3Gbps peaks, no problem. 

On lesser hardware, your mileage will definitely vary. The secret sauce appears to be the DAG. Hot CPUs doesn't hurt either. :) You'll probably find that an Endace will cost as much as the server you'd put it in. I think it's worthwhile, but your budget is yours.

It doesn't actually consume all of the above resources - I'm running other things on the box too - but bro itself consumes ~4.5GB resident per worker, and can be counted on to pin most of its allocated cores at peak loads.

Mike

On 2013-03-19, at 1:49 PM, keqhe at cs.wisc.edu wrote:

> 
> Hello,
> 
> Does any one know Bro's processing speed? i.e., can it support monitoring
> 1 Gbps or 10Gbps link?
> 
> Thanks!
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro