Snort mailing list archives
Re[2]: performance snort question
From: Lee Smallbone <lee () smallbone com>
Date: Tue, 19 Jun 2001 23:11:08 +0100
MH> I know this doesn't pertain to the current thread exactly....but... MH> I just got a alpha EV56 600mhz with 256megs of ram and a two(2) tulip MH> chip set based NICs. Does the list think that would handle 2 fully MH> statuated 100mbs lines? It'd be loggin to a mysql database or a .dbi MH> file. Think the machine will be able to handle it? IMO, yes. MH> On Tue, Jun 19, 2001 at 09:43:06PM +0100, Lee Smallbone wrote:
RW> I you use logging into MySQL, you must have a better configuration. RW> But, yes, I think this works fine when just Snort logs into txt file. Not a major concern in my instance as all logging is made to a central MySQL server. If you intend to log locally to an SQL server, consider doubling the below specification, especially if you intend to also run something like ACID on the same box. /LeeLee Smallbone <lee () smallbone com> writes:Tuesday, June 19, 2001, 8:44:42 AM, you wrote: EHS> I haven't seen an answer to Roeland's questions so far. I am EHS> currently considering building a snort box wich should be able to EHS> withstand a saturated 100mbps in worst-case, and have been unable to EHS> find even the slightest hint on what hardware requirement would be EHS> needed to do that. The author seems fairly sure that a 486 should be able to keep up with a 100mbit/s link. I'd go one step further and use the following configuration so I know it would be there if it was needed: o) old pentium of some sort (P90/100) o) 32-64mb ram o) Large disk to cope with logs (pref SCSI or ATA100) o) Decent, trusted 100mbit/s NICThank you very much for your answer! I really needed this information to support my push for building a snort based IDS box :) /Esben _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-usersRW> -- RW> Netland Internet Services RW> bedrijfsmatige internetoplossingen RW> http://www.netland.nl Kruislaan 419 1098 VA Amsterdam RW> info: 020-5628282 servicedesk: 020-5628280 fax: 020-5628281 Best regards, Lee mailto:lee () smallbone com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
MH> Mitchell Henderson mitchell () cts wustl edu _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- performance snort question Roeland Weve (Jun 18)
- Re: performance snort question Esben Haabendal Soerensen (Jun 19)
- Re[2]: performance snort question Lee Smallbone (Jun 19)
- Re: Re[2]: performance snort question Esben Haabendal Soerensen (Jun 19)
- Re: performance snort question Roeland Weve (Jun 19)
- Re: performance snort question Esben Haabendal Soerensen (Jun 19)
- Re: performance snort question Roeland Weve (Jun 19)
- Re: performance snort question Ralf Hildebrandt (Jun 19)
- Re[2]: performance snort question Lee Smallbone (Jun 19)
- Re[2]: performance snort question Lee Smallbone (Jun 19)
- Re: performance snort question Esben Haabendal Soerensen (Jun 19)
- <Possible follow-ups>
- RE: Re[2]: performance snort question Thomas Whipp (Jun 19)
- Re[2]: performance snort question Lee Smallbone (Jun 19)