RE: Good Gbit card for Snorting?

["Bob Walder" <bwalder () nss co uk>]

Abe,

Hey... all suggestions welcome .... we might not take them all on board, of
course.... ;o)

Seriously, given the constraint that we don't want to turn this into a
massive comparison test between different gigabit cards or OS platforms
(perhaps that may come later, but not for now) then we would be happy to
hear any suggestions as to how we could optimise the reference platform(s).

At present, we are planning:

Intel Pentium III 1GHz
768MB SDRAM
Intel Pro/1000T Server adapter (Gigabit)
FreeBSD 4.4

Intel Pentium 4 1.8GHz
Intel 850 chipset
512MB RDRAM
Intel Pro/1000T Server adapter (Gigabit)
FreeBSD 4.4

Tested on both 100Mbit and Gigabit network
Same platform with Intel Pro/100 adapter on 100Mbit network
We may get to test on Red Hat 7.x too if time permits

As I said, the aim is to see just how much performance we can squeeze out of
Snort, so any previous experiences of optimising Snort, memory usage, the
adapter/driver combination or the underlying OS are welcome.

Regards,

Bob Walder


-----Original Message-----
From: Abe L. Getchell [mailto:abegetchell () home com]
Sent: 13 November 2001 20:46
To: Bob Walder
Cc: snort-users () lists sourceforge net
Subject: RE: [Snort-users] Good Gbit card for Snorting?


Hi Bob,
        BSD?  I mean, come on, it's not like it's the OS that Snort is
developed on or anything... Oh wait. =)  Are you going to allow the
community to provide input into the optimization process?  It seems that
one rant I always hear after an evaluation of a product is published, is
that the organization doing the testing didn't tweak <insert something
obscure here> to allow the box to burn through data a tad more quickly.
It would be really cool if you would take in some collective knowledge
from the community, as I'm sure some of the guys/gals here working in
the trenches have some interesting tricks up their sleeves...

Thanks,
Abe

--
Abe L. Getchell
Security Engineer
abegetchell () home com


> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of
> Bob Walder
> Sent: Tuesday, November 13, 2001 3:43 AM
> To: abegetchell () home com
> Cc: snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Good Gbit card for Snorting?
>
>
> Abe,
>
> You get to see this twice since I forgot to cc the list the
> first time.... d'oh!
>
> No plans to do this at present, since we have pretty much
> settled on FreeBSD as our reference platform. The plan is to
> build a complete box, optimised as far as possible in every
> respect, as a sort of "proof of concept" to see how fast
> Snort can go on a platform made up of freely available components.
>
> Regards,
>
> Bob
>
>
> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net]On Behalf Of
> Abe L. Getchell
> Sent: 13 November 2001 01:25
> To: Bob Walder
> Cc: snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Good Gbit card for Snorting?
>
>
> Hi Bob,
>
> Any plans to benchmark the Gbit sensor on the same hardware
> running different OS's?  It would be nice to see how the
> multiple x86 OS's Snort runs on would perform using the same
> hardware under the same conditions at Gbit speeds.
> Regardless, can't wait to see the results.  Please do post a
> note to the list when you're done as I'm sure many of us here
> are eager.
>
> Thanks,
> Abe
>
> --
> Abe L. Getchell
> Security Engineer
> abegetchell () home com
>
>
> > -----Original Message-----
> > From: Bob Walder [mailto:bwalder () nss co uk]
> > Sent: Monday, November 12, 2001 4:24 AM
> > To: abegetchell () home com; snort-users () lists sourceforge net
> > Subject: RE: [Snort-users] Good Gbit card for Snorting?
> >
> >
> > Abe,
> >
> > Might not fit into your time scales, but we are about to build a
> > reference platform using high-end Pentium, lots of RAM,
> Intel Gigabit
> > card, FreeBSD 4.4 and Snort - just to see what it can do.
> We probably
> > won't get around to testing it until December, however.
> Results will
> > be made public
> >
> > Regards,
> >
> > Bob Walder
> > Director
> >
> > The NSS Group
> > England
> >
> > Internet: http://www.nss.co.uk
> >
> >
> > -----Original Message-----
> > From: snort-users-admin () lists sourceforge net
> > [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Abe L.
> > Getchell
> > Sent: 11 November 2001 20:50
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] Good Gbit card for Snorting?
> >
> >
> > Greetings!
> >
> > Has anyone run into a particular Gbit card which has worked
> well for
> > them under Linux for Snorting?  I've searched on Google, as well as
> > other resources, and can't really come up with anything
> except people
> > sharing their bad experiences doing so. =)  I tend to lean towards
> > Intel, as I've had good experiences in the past with their 10/100
> > cards, but I thought I'd check with ya'll to see what the collective
> > community opinion was.
> >
> > Thanks,
> > Abe
> >
> > --
> > Abe L. Getchell
> > Security Engineer
> > abegetchell () home com
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/s> nort-users
> >
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users