Re: Question about best hardware

[Michael Sconzo <msconzo () tamu edu>]

This may seem a bit off topic, but why not buy a SourceFire Gig
Box.  While the home-gown versions work great on 100MB links, I
would recommending their Gig box.  They do things "the right way(TM)"
and display all of the data quite nicely.  They are a bit pricey,
but you might give them a look.  It also means you don't have to
admin a box that you are not familiar with (relating to your distro
question).

But if you want to build your own, I would use SuSE 64 Enterprise
on the Optron, and we have gotten good performace out of Intel Nics
(especially at high data speeds with small packets)  I would also
look more into the area of 2-4gb of RAM, but with this setup disk
(in worse case senario) is what's going to be slowing you down.  
We have done a bit of playing with the configuration above around 
here.

-=Mike

On Thu, Mar 04, 2004 at 10:54:17AM -0800, Mike Cohen wrote:
> Hi Folks, 
>
> Im am beginning snort user, and I have been asked to spec a production snort
> server to do the following:
>
> Monitor all traffic in and out of a relatively busy Mail Server(300 users).
> The mail server is on a gigabit link and is usually at about 300mbs average
> usage, it rarely gets super saturated.
>
> I will be storing the logs on the snort box itself and I have to use a
> hardware raid solution.
>
> I am told I must spec an HP brand server and I have the following questions.
>
> 1. I thought I remembered reading that Opterons have an advantage when
> trying to sniff gigabit traffic , but I have never used an opteron, and as
> an intermediate Linux User Im not entirely confident trying to force linux
> to work on a new architecture, are there any problems with linux and snort
> on an opteron.
>
> 2. How much memory do I need? I specd 1gb, is this sufficient for high
> usage?
>
> 3. Which distro is best for an intermediate level Linux user? I know that
> there is no cut and dry answer to this question, but if anyone has any
> insight on using snort on a RAID 1 box , using an opteron on gigabit please
> chime in.
>
> If anyone has any other insights as to recommended hardware please let me
> know.
>
> Thanks.
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
The New Testament offers the basis for modern computer coding theory,
in the form of an affirmation of the binary number system.
        But let your communication be Yea, yea; nay, nay: for
        whatsoever is more than these cometh of evil.
                -- Matthew 5:37


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users