ESP32 Ethernet passive IDS: packet-processing bottlenecks and migration to ESP32-P4
Posted: Tue Aug 25, 2026 12:05 am
Hi,
I'm developing an open-source research prototype that uses an ESP32 as a
passive industrial Ethernet monitoring and intrusion-detection device.
The device receives mirrored traffic from an Ethernet switch and performs
packet processing while keeping the monitored OT network completely outside
the management interface.
The current hardware provides:
- dual-core ESP32 @ 240 MHz
- 16 MB Flash
- 8 MB PSRAM
- 10/100 Ethernet with PoE
The processing pipeline includes protocol identification/parsing, allowlists,
session tracking, signatures and some statistical analysis.
The architecture works well with relatively small traffic loads, but the next
challenge is sustained packet processing as network traffic increases.
I'm now evaluating ESP32-P4-class hardware.
I'm particularly interested in experiences or benchmarks concerning:
- sustained Ethernet packets per second rather than only Mbps
- DMA and Ethernet buffer management
- zero-copy or reduced-copy packet processing
- internal SRAM vs PSRAM for packet queues
- FreeRTOS task/core separation
- profiling packet loss under CPU load
- Ethernet driver tuning
- ESP32-P4 suitability for packet-heavy workloads
Before simply moving to more powerful hardware, I would like to understand
which parts of the architecture should be optimized first.
The project is open source and the packet-processing architecture can be
inspected here:
https://github.com/il-prof-f-a/ESP32-OT ... Assessment
Has anyone worked on a comparable sustained Ethernet workload on ESP32 or
ESP32-P4?
I'm developing an open-source research prototype that uses an ESP32 as a
passive industrial Ethernet monitoring and intrusion-detection device.
The device receives mirrored traffic from an Ethernet switch and performs
packet processing while keeping the monitored OT network completely outside
the management interface.
The current hardware provides:
- dual-core ESP32 @ 240 MHz
- 16 MB Flash
- 8 MB PSRAM
- 10/100 Ethernet with PoE
The processing pipeline includes protocol identification/parsing, allowlists,
session tracking, signatures and some statistical analysis.
The architecture works well with relatively small traffic loads, but the next
challenge is sustained packet processing as network traffic increases.
I'm now evaluating ESP32-P4-class hardware.
I'm particularly interested in experiences or benchmarks concerning:
- sustained Ethernet packets per second rather than only Mbps
- DMA and Ethernet buffer management
- zero-copy or reduced-copy packet processing
- internal SRAM vs PSRAM for packet queues
- FreeRTOS task/core separation
- profiling packet loss under CPU load
- Ethernet driver tuning
- ESP32-P4 suitability for packet-heavy workloads
Before simply moving to more powerful hardware, I would like to understand
which parts of the architecture should be optimized first.
The project is open source and the packet-processing architecture can be
inspected here:
https://github.com/il-prof-f-a/ESP32-OT ... Assessment
Has anyone worked on a comparable sustained Ethernet workload on ESP32 or
ESP32-P4?