# Hardware characteristic **URL:** \ **Category:** Zeek\ **Created:** [July 30, 2000, 5:28pm UTC](https://community.zeek.org/t/hardware-characteristic/105 "2000-07-30T17:28:50Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [July 30, 2000, 5:28pm UTC](https://community.zeek.org/t/hardware-characteristic/105/1 "2000-07-30T17:28:50Z")
> What are the characteristics to look at when buying hardware to run Bro on? Something that can run an OS that supports kernel BPF. E.g., FreeBSD, NetBSD, BSDi, Tru64. There are no doubt others, and I believe there's a kernel BPF port for Linux in the works, but I don't know if anyone is shipping it. > Which values do you suggest to monitor a 100Mbps link or a Gigabit link? The key is not the link speed so much as the traffic volume over that link, and, in particular, the volume of traffic accepted by the packet filter. In the past, we've successfully monitored some medium-sized sites (2000 users) with 400 MHz Pentiums running FreeBSD. You should have a good amount of memory, say 256 MB or more. If you have a few hundred users, then a vanilla 9 GB will probably work fine. If you have a lot more, then larger drives. It also depends on how long a record you want to keep on-line. (Experience shows you'll at least want a week, to allow retrospective analysis of activity.) We use the CCD driver under FreeBSD to stripe several drives together into one large, fast partition, and also have an off-line archive machine that we keep everything other than the raw traces for quite a ways back.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/hardware-characteristic/105/2 "2022-05-06T15:36:12Z")