Did somebody have information on the number of packets per second
successfully processed by Bro?
It depends on how you want to cook the figure. It runs routinely on a link
here with about 12,000 pps sustained, and peaks of 18,000 pps. (Well, used
to; due to a topology change, the links I now routinely run it on have lower
rates.) But it filters out a whole lot of the traffic. The number quoted
in the revised Bro paper was one test showing it sustained 730 filtered
packets/sec sustained, with peaks of 1,200 pps, without drops (it's possible
it could have accommodated more, that was the highest-volume traffic stream
I had convenient). This was measured in 1998 on what is now very modest
Intel hardware. I haven't stressed tested it on higher streams, so don't
have a good upper figure. Clearly, I should do that, in my copious spare
time ...
Vern