Gigabit link monitoring

What's crucial is the make-up of the traffic: how much is there, how much
of it matches the filter, and what sort of analysis has to be performed
for the captured traffic.

Right. I just assumed a high load gigabit network where one bro
would need to do a lot of processing.

Anyway, having several bros monitoring different traffic would
also help...