ESP32 Ethernet passive IDS: packet-processing bottlenecks and migration to ESP32-P4

[proffa]

Hi,

I'm developing an open-source research prototype that uses an ESP32 as a
passive industrial Ethernet monitoring and intrusion-detection device.

The device receives mirrored traffic from an Ethernet switch and performs
packet processing while keeping the monitored OT network completely outside
the management interface.

The current hardware provides:

- dual-core ESP32 @ 240 MHz
- 16 MB Flash
- 8 MB PSRAM
- 10/100 Ethernet with PoE

The processing pipeline includes protocol identification/parsing, allowlists,
session tracking, signatures and some statistical analysis.

The architecture works well with relatively small traffic loads, but the next
challenge is sustained packet processing as network traffic increases.

I'm now evaluating ESP32-P4-class hardware.

I'm particularly interested in experiences or benchmarks concerning:

- sustained Ethernet packets per second rather than only Mbps
- DMA and Ethernet buffer management
- zero-copy or reduced-copy packet processing
- internal SRAM vs PSRAM for packet queues
- FreeRTOS task/core separation
- profiling packet loss under CPU load
- Ethernet driver tuning
- ESP32-P4 suitability for packet-heavy workloads

Before simply moving to more powerful hardware, I would like to understand
which parts of the architecture should be optimized first.

The project is open source and the packet-processing architecture can be
inspected here:

https://github.com/il-prof-f-a/ESP32-OT ... Assessment

Has anyone worked on a comparable sustained Ethernet workload on ESP32 or
ESP32-P4?

[mikemoy]

I'd skip the P4 and go with the ESP32-S31.
get a dev board and try it out.
https://www.aliexpress.us/item/32568121 ... 4itemAdapt

[MicroController]

I would like to understand which parts of the architecture should be optimized first

Obviously, you'd need to first find out where the actual bottlenecks are.
For example, the "ESP32-S3 + W5500 SPI Ethernet" combination will be inherently speed-limited by the SPI.