Snort mailing list archives

Re: performance snort question


From: Roeland Weve <roeland () office netland nl>
Date: Tue, 19 Jun 2001 13:44:13 +0200

I you use logging into MySQL, you must have a better configuration.
But, yes, I think this works fine when just Snort logs into txt file.


Lee Smallbone <lee () smallbone com> writes:

Tuesday, June 19, 2001, 8:44:42 AM, you wrote:

EHS> I haven't seen an answer to Roeland's questions so far.  I am
EHS> currently considering building a snort box wich should be able to
EHS> withstand a saturated 100mbps in worst-case, and have been unable to
EHS> find even the slightest hint on what hardware requirement would be
EHS> needed to do that.

 The author seems fairly sure that a 486 should be able to keep up
 with a 100mbit/s link. I'd go one step further and use the following
 configuration so I know it would be there if it was needed:

               o) old pentium of some sort (P90/100)
               o) 32-64mb ram
               o) Large disk to cope with logs (pref SCSI or ATA100)
               o) Decent, trusted 100mbit/s NIC

Thank you very much for your answer!  I really needed this information
to support my push for building a snort based IDS box :)

/Esben

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Netland Internet Services
bedrijfsmatige internetoplossingen

http://www.netland.nl   Kruislaan 419              1098 VA Amsterdam
info: 020-5628282       servicedesk: 020-5628280   fax: 020-5628281

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: