[Bro] 10 Gb capable Bro cluster

[DJ Root]

Hi Earl,

Yes, we have built a cluster capable of processing 10Gbps.  We have this running in our lab and also have reference-able customers.

Hardware:
 - Dual socket Ivy Bridge X86 with cores running at 2.8GHZ
-  Netronome PCIe acceleration technology 

2U appliance is capable of 8.5 - 9.0Gbps Bro processing in steady state, peak 20Gbps+ with few packet drops (~2%).  Our 4U cluster can process 17-18Gbps of Bro steady state, peak 40-45Gbps.

Resources used:  32 worker threads on each 2U appliance / 4 threads for NIC management / 12 are unused and can be utilized for other applications.  Bro is not modified.

Let me know if you need anything else.

Thanks,
DJ Root
Netronome, Inc.
(617)686-0253

> On Apr 2, 2015, at 5:52 PM, Earl Eiland <earl.eiland at root9b.com> wrote:
> 
> Has anyone built a Bro cluster capable of processing packets at 10Gb/sec?  If so, what hardware did you use?
>  
> Best Regards,
>  
> Earl Eiland,
> Sr. Cyber Security Engineer,
> Emerging Technologies, root9B,
> San Antonio, Texas
>  
> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity named.  If you are not the named addressee you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.  Please notify the sender immediately by email if you received this email in error and delete this email from your system. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of root9B LLC.​
>  
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org <mailto:bro at bro-ids.org>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro <http://mailman.icsi.berkeley.edu/mailman/listinfo/bro>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150403/9b21b6ba/attachment.html