# Dataset for Bro evaluation

**URL:** <https://community.zeek.org/t/dataset-for-bro-evaluation/4589>\
**Category:** Zeek\
**Created:** [January 11, 2017, 9:17pm UTC](https://community.zeek.org/t/dataset-for-bro-evaluation/4589 "2017-01-11T21:17:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hongda\_Li](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@Hongda\_Li](https://community.zeek.org/u/Hongda_Li)\
**Post date:** [January 11, 2017, 9:17pm UTC](https://community.zeek.org/t/dataset-for-bro-evaluation/4589/1 "2017-01-11T21:17:19Z")

</div>

Hello all,

I would like to do some evaluation of Bro.

My plan is to:  
(1) Replay network traffic dataset to Bro and observe its CPU/memory usage.  
(2) Replay network traffic dataset to Bro and observe the throughput achieved by Bro without dropping packets.  
(3) Replay network traffic dataset to Bro with different configurations (e.g., enable some of the scripts) and observe the CPU/memory usage, throughput, etc.

I guess datasets without payloads (e.g., LBNL/ICSI enterprise traces) are not suitable for my plan, since the performance of Bro depends on the content of the traffic.  
But it is difficult to get access to the traffic datasets with payloads due to privacy issues.  
Does anybody have any suggestions to help accomplish the tasks listed in the above plan?

Also, if necessary, I want to start a thread here discussing how you (researchers, operators and developers) effectively evaluate Bro.

Appreciate any comments.

Best regards,Hongda

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [January 11, 2017, 9:49pm UTC](https://community.zeek.org/t/dataset-for-bro-evaluation/4589/2 "2017-01-11T21:49:51Z")

</div>

Hongda Li \<hongdal@g.clemson.edu\> writes:

> But it is difficult to get access to the traffic datasets with payloads due  
> to privacy issues.  
> Does anybody have any suggestions to help accomplish the tasks listed in  
> the above plan?
> 
> Also, if necessary, I want to start a thread here discussing how you  
> (researchers, operators and developers) effectively evaluate Bro.

I would recommend creating your own dataset and using that. It will be  
the best way to evaluate performance based on your particular traffic.

&nbsp;&nbsp;--Vlad

---

<div class="post-metadata">

**Author:** ![Hongda\_Li](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@Hongda\_Li](https://community.zeek.org/u/Hongda_Li)\
**Post date:** [January 11, 2017, 10:10pm UTC](https://community.zeek.org/t/dataset-for-bro-evaluation/4589/3 "2017-01-11T22:10:49Z")

</div>

> I would recommend creating your own dataset and using that. It will be

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/dataset-for-bro-evaluation/4589/4 "2022-05-06T15:44:28Z")

</div>