What's crucial is the make-up of the traffic: how much is there, how much
of it matches the filter, and what sort of analysis has to be performed
for the captured traffic.
Right. I just assumed a high load gigabit network where one bro
would need to do a lot of processing.
Anyway, having several bros monitoring different traffic would
also help...