Even if you can capture the traffic at wire speed, the CPU doesn't have the power to analyse the stream. I thought that traffic analysers had to be done with FPGA/ASIC because of that.
My manager did his thesis on this. Endace NICs, split traffic up and send to a cluster of IDS servers. Allows you to actually do line rate analysis. No need for FPGA/ASIC.
