Suricata

Flows track number of packets, so adding a total ticks count would allow calculating an average.

We could then output (in the flow log):
- absolute and relative cost of a flow

Also, a simple keyword could perhaps match on this. Then we'd alert on overly expensive flows (and even drop/pass them?).

Both should greatly help debugging performance issues.