Can you share this paper you are referring to? I work in this space, and I've never seen Bro perform very well. Processing 50Gbps for Bro is no small task... so, I'm very curious about this... please sure if you don't mind.I found a paper discussing running the Bro IDS on an Arista switch. They had it setup where the VM read the events and offloaded to collectors on compute nodes. With a few nodes they were able to process 50Gbps real-time. They said the limitation to getting to 100Gbps wasn't the switch, but the collector nodes.