http://luca.ntop.org/Ring.pdf gives some interesting insights into 
packet capture architectures.  I knew that stock systems didn't do very 
well; I'm astonished at how poorly they do at monitoring a network.


		--Steve Bellovin, http://www.research.att.com/~smb