[Bro] NIC recommends

James Lay jlay at slave-tothe-box.net
Tue Jan 26 04:05:04 PST 2016


On Mon, 2016-01-25 at 23:50 +0100, Michał Purzyński wrote:
> We have been running Bro sensors with multiple Myricom cards here,
> 10Gbit per sensor (it's the interface speed, not the actual traffic)
> with the Sniffer v3 software. Rock solid, with a few minor problems
> from time to time. Traffic is load balanced with the Arista switch in
> tap aggregator mode.
> 
> 
> 
> 
> 
> 
> 
> 
> Sent from my iPhone
> 
> On 25 Jan 2016, at 23:21, Brandon Glaze <bglaze at gmail.com> wrote:
> 
> 
> > James,
> > 
> > 
> > I have had really good luck with the Netronome NFE-3240 NIC's. I
> > have only run them to 20Gbps each. Their NFP-6xxx series have
> > multiple 100Gb or 40Gb interfaces, and their support is awesome
> > (they helped me build my Bro servers initially).
> > 
> > 
> > 
> > The Berkeley Lab 100Gb bro sensors (search for
> > 100GIntrusionDetection) used Myricom 10GPCIE28C22+ cards, and their
> > PDF has all the configs (plus its a great practical research and
> > proof of concept paper). I am sure Myricom has 40Gb cards, but you
> > would have to research it.
> > 
> > 
> > 
> > =====================
> > Brandon Glaze
> > bglaze at gmail.com
> > 
> > 
> > 
> > "Lead me, follow me, or get the hell out of my way." 
> > - General George Patton Jr
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > On Mon, Jan 25, 2016 at 1:39 PM, James Lay
> > <jlay at slave-tothe-box.net> wrote:
> > 
> >         Hey All,
> >         
> >         Topic says it....sizing up for capturing LAN
> >         traffic...thinking a 40 or
> >         even 100 gig nic.  This would be a single machine doing
> >         nothing else but
> >         bro.  Thanks for any assistance.
> >         
> >         James
> >         _______________________________________________
> >         Bro mailing list
> >         bro at bro-ids.org
> >         http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > 
> > 
> > 
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

Thank you Michat...I will also take a look at those cards.

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160126/5c348495/attachment-0001.html 


More information about the Bro mailing list