incoming traffic

Zeek
1

hi there

Just wondering if there is a known incoming speed limit at which Bro will perform to its best? I refer to the traffic speed (100Mbps ?)

thanks

2

Just wondering if there is a known incoming speed limit at which Bro
will perform to its best? I refer to the traffic speed (100Mbps ?)

This isn't really a well-formed question: too much depends on the specifics
of your traffic mix, the sorts of analysis you want to perform, and your
hardware platform. We use Bro operationally at LBL and NERSC to monitor
10 Gbps links using commodity PCs. However, monitoring UC Berkeley's
traffic (slower links, technically, but much busier anyway) requires the
user of a clusterized Bro.

That said, if 100 Mbps is the speed you wish to monitor, that should
certainly be doable.

    Vern