We measure the performance of a modern PC host running a
novel network monitoring system.  The goal of the analysis
is to understand system performance under gigabit load with
both maximum-sized and minimum-sized Ethernet frames.  The
network monitoring system used, {\it Ourmon}, is of our own
construction, and is briefly summarized in the full paper.
Our testbed consists of: an IXIA 1600 high-speed packet
generator that can send packets at near theoretical speeds;
a gigabit switch; and a near 2 GHz AMD PC host.  We measure the
performance of the underlying BPF network tap on FreeBSD, as
well as the performance of various application-layer filters
used by the Ourmon system. We show that using a BSD BPF
kernel buffer size of several megabytes permits a
workstation using the Ourmon filters to capture back-to-back
maximum-sized Ethernet packets at Gigabit speeds.  We also
show that when minimum-sized packets are sent, the
BPF/Ourmon system utterly fails at a relative small
throughput rate: this failure appears to be due to
limitations of the hardware and/or network stack rather than
the Ourmon system proper.  This result has troubling
implications for network management and intrusion detection
systems, given the current frequency of large volume
Internet attacks using small packets.