[Bro] About Bro Processing Speed
Vlad Grigorescu
vladg at cmu.edu
Tue Mar 19 11:35:10 PDT 2013
Just to throw another data point out there:
> * 16 physical cores of model name : Intel(R) Xeon(R) CPU E5-2680 @ 2.70 GHz
> * 96GB of RAM
> * Myricom NIC
28 workers (I have Hyperthreading turned on) keep up with a 6-7 Gbps average, and I've seen them do fine with short peaks of 9 Gbps or so. The Myricom cards definitely won't break the bank: card + SR optics + perpetual license is $895.
--Vlad
On Mar 19, 2013, at 2:20 PM, Mike Patterson <mike.patterson at uwaterloo.ca>
wrote:
> "It depends."
>
> On - hardware, mostly, and configuration.
>
> I keep meaning to write this up, but on *my* configuration:
> * 16 cores of model name : Intel(R) Xeon(R) CPU X5677 @ 3.47GHz
> * 72GB of RAM
> * Endace DAG (9.2)
> * some config magic by Seth, which I'd be happy to share.
>
> 6 workers keep up with ~2.5-3Gbps peaks, no problem.
>
> On lesser hardware, your mileage will definitely vary. The secret sauce appears to be the DAG. Hot CPUs doesn't hurt either. :) You'll probably find that an Endace will cost as much as the server you'd put it in. I think it's worthwhile, but your budget is yours.
>
> It doesn't actually consume all of the above resources - I'm running other things on the box too - but bro itself consumes ~4.5GB resident per worker, and can be counted on to pin most of its allocated cores at peak loads.
>
> Mike
>
> On 2013-03-19, at 1:49 PM, keqhe at cs.wisc.edu wrote:
>
>>
>> Hello,
>>
>> Does any one know Bro's processing speed? i.e., can it support monitoring
>> 1 Gbps or 10Gbps link?
>>
>> Thanks!
>>
>>
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
More information about the Bro
mailing list