Snort mailing list archives
RE: Snort and high performance networks
From: "Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>
Date: Fri, 21 May 2004 14:09:22 -0500
Our 3-4Gbps system is one system with built in quad-gigE interfaces. We have no 10Gbps interfaces deployed (yet), as we have no need for them (and no network pushing that kind of data yet). The vast majority of the time, the system is handling less than 1Gbps. However, there are periods of time, on a daily basis, when the threshold is neared. For the most part, the way we first verified these systems would handle 3-4G each was to use tcpreplay in a manner that's being discussed now by Gary Portnoy. Check out his most recent post. As far as handling 30Gbps, I'm fairly certain even if it was quad-10GigE, we could NOT handle it. It appears from the performance of these systems that they could probably handle closer to 5-6 Gbps... But that's just my theory. -----Original Message----- From: SN ORT [mailto:snort_on_acid () yahoo com] Sent: Friday, May 21, 2004 1:14 PM To: snort-users () lists sourceforge net Cc: rafael.ortega () telecarrier com; rapier () psc edu; Kreimendahl, Chad J Subject: RE: [Snort-users] Snort and high performance networks Are you guys ACTUALLY running traffic at 800Mbps or even 2-3 Gbps? I mean what application or server process that much data on the line? This dood stated he had an OC-whatever pumping 30Gbps, and Chad asked a very appropriate question as to how on earth anyone would Snort that line short of buying a machine with an OC-3 $$ (CHA-CHING!) interface stuck in it. Most people would use Sniffer with a WAN interface and network fiber taps to get "quick snapshots". Back to the 3-4Gbps line, you have 10Gbps interfaces deployed already? How exactly are you seeing 3-4Gbps traffic, and is it steady and what applications use that? I mean most switches see that kind of total backbone traffic and you can actually use switch-based IDS (like the one from Cisco)...unless of course you have a 10Gbps backbone, but to where does that much traffic travel? Cheese! Marc ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id149&alloc_id66&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Snort and high performance networks, (continued)
- Re: Snort and high performance networks Chris Rapier (May 20)
- RE: Snort and high performance networks Rafael Ortega (Jun 01)
- RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
- RE: Snort and high performance networks Rafael Ortega (May 21)
- Re: Snort and high performance networks Jason Haar (May 23)
- RE: Snort and high performance networks snort user (May 21)
- Re: Snort and high performance networks Christopher Rapier (May 21)
- RE: Snort and high performance networks Rafael Ortega (May 21)
- Re: Snort and high performance networks snort user (May 21)
- RE: Snort and high performance networks SN ORT (May 21)
- RE: Snort and high performance networks Kreimendahl, Chad J (May 21)
- Re: Snort and high performance networks Aaron (May 24)
- High Speed Network Cards + rules? Adriel T. Desautels (May 24)
- Re: High Speed Network Cards + rules? Keith W. McCammon (May 24)
- Re: High Speed Network Cards + rules? Christopher Rapier (May 24)
- Re: High Speed Network Cards + rules? Matt Kettler (May 24)
- Re: High Speed Network Cards + rules? James Riden (May 24)
- Re: High Speed Network Cards + rules? James Riden (May 25)
- High Speed Network Cards + rules? Adriel T. Desautels (May 24)
- Re: High Speed Network Cards + rules? Tod Beardsley (May 24)
- Re: Re: Snort and high performance networks Aaron (May 25)