Re: Snort and L2 Cache

[Dirk Geschke <Dirk () geschke-online de>]

Hi Irwan,

> I'm curious, for a new Snort box which one will be better?
> Use dual processor, P IV Xeon with for example 2.8 Ghz and 512 KB L2
> Cache, or single processor P IV Xeon with 3.06 Ghz but with 1 MB L2
> Cache?
> Does the size of L2 cache of the processor matters in speeding up Snort,
> especially in monitoring gigabit Ethernet traffic?

I think the more important question is: What should run on
this machine? If it is only for running snort then you won't
have much advantage of a second processor if are only running
one instance of snort. (Snort does not use threads and is
therefore bound to one processor.)

If you have additionally a database running on the same 
machine then I think it would be better to have two processors.

But this is not a question of the L2 Cache...

Best regards

Dirk Geschke



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users