Hey All,
Topic says it....sizing up for capturing LAN traffic...thinking a 40 or even 100 gig nic. This would be a single machine doing nothing else but bro. Thanks for any assistance.
James
James,
I have had really good luck with the Netronome NFE-3240 NIC’s. I have only run them to 20Gbps each. Their NFP-6xxx series have multiple 100Gb or 40Gb interfaces, and their support is awesome (they helped me build my Bro servers initially).
The Berkeley Lab 100Gb bro sensors (search for 100GIntrusionDetection) used Myricom 10GPCIE28C22+ cards, and their PDF has all the configs (plus its a great practical research and proof of concept paper). I am sure Myricom has 40Gb cards, but you would have to research it.
Wonderful information…thanks so much.
James
We have been running Bro sensors with multiple Myricom cards here, 10Gbit per sensor (it’s the interface speed, not the actual traffic) with the Sniffer v3 software. Rock solid, with a few minor problems from time to time. Traffic is load balanced with the Arista switch in tap aggregator mode.
Thank you Michat…I will also take a look at those cards.
James