[Bro] About Bro Processing Speed

[keqhe at cs.wisc.edu]

Thanks for the helpful information!
> Just to throw another data point out there:
>
>> * 16 physical cores of model name	: Intel(R) Xeon(R) CPU E5-2680 @ 2.70
>> GHz
>> * 96GB of RAM
>> * Myricom NIC
>
> 28 workers (I have Hyperthreading turned on) keep up with a 6-7 Gbps
> average, and I've seen them do fine with short peaks of 9 Gbps or so. The
> Myricom cards definitely won't break the bank: card + SR optics +
> perpetual license is $895.
>
>   --Vlad
>
> On Mar 19, 2013, at 2:20 PM, Mike Patterson <mike.patterson at uwaterloo.ca>
>  wrote:
>
>> "It depends."
>>
>> On - hardware, mostly, and configuration.
>>
>> I keep meaning to write this up, but on *my* configuration:
>> * 16 cores of model name	: Intel(R) Xeon(R) CPU           X5677  @
>> 3.47GHz
>> * 72GB of RAM
>> * Endace DAG (9.2)
>> * some config magic by Seth, which I'd be happy to share.
>>
>> 6 workers keep up with ~2.5-3Gbps peaks, no problem.
>>
>> On lesser hardware, your mileage will definitely vary. The secret sauce
>> appears to be the DAG. Hot CPUs doesn't hurt either. :) You'll probably
>> find that an Endace will cost as much as the server you'd put it in. I
>> think it's worthwhile, but your budget is yours.
>>
>> It doesn't actually consume all of the above resources - I'm running
>> other things on the box too - but bro itself consumes ~4.5GB resident
>> per worker, and can be counted on to pin most of its allocated cores at
>> peak loads.
>>
>> Mike
>>
>> On 2013-03-19, at 1:49 PM, keqhe at cs.wisc.edu wrote:
>>
>>>
>>> Hello,
>>>
>>> Does any one know Bro's processing speed? i.e., can it support
>>> monitoring
>>> 1 Gbps or 10Gbps link?
>>>
>>> Thanks!
>>>
>>>
>>> _______________________________________________
>>> Bro mailing list
>>> bro at bro-ids.org
>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>
>>
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>