Snort mailing list archives
RE: Help me choose which system to run snort on.
From: "Jim Hendrick" <jrhendri () maine rr com>
Date: Tue, 30 Nov 2004 07:04:35 -0500
I'd lean towards the dual processor myself given the number of applications slated for that one box. Linux is very good at balancing load (even if it were only running snort, the OS "normal" maintenance processes could take advantage of the other CPU). I am currently running 2 snort instances, apache, mysql & acid on a dual 933 linux box w/ 1.5GB RAM and 2x 15K SCSI drives very happily. Most of the time the CPUs are idle. The key is memory and fast disks though. Even a dual CPU will need to swap processes. More memory ==> less often, and faster disks ==> it happens more quickly. Think about the orders of speed here: disks have access times in the ~10ms range (more or less) memory is *much* faster. more RAM will help (~2GB) and then if you can go for multiple faster drives (15K SCSI) to separate the OS and swap, and the database and log files, all the better. Good luck! Jim Hendrick GCFW, GCIA, GCIH -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Basselgia, Barry A Mr (NAF Atsugi) Sent: Tuesday, November 30, 2004 1:06 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Help me choose which system to run snort on. I'm building an IDS network, I'll end up with about 6 snort sensors feeding back to a snort server. The snort server will be running: Linux mysql apache snort barnyard acid/base open aanval There are 2 servers available and I've been given my choice. Basically, the servers are the same with regard to memory and hard drives. The difference is that one is a dual processor system with 2 x 1 GHz processors and the other is a single processor system with a 2 GHz processor. I'm kind of leaning towards the dual processor system, but I wanted to see if anyone had any suggestions before I made up my mind. Thanks, Barry ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Help me choose which system to run snort on. Basselgia, Barry A Mr (NAF Atsugi) (Nov 29)
- RE: Help me choose which system to run snort on. Jim Hendrick (Nov 30)
- <Possible follow-ups>
- RE: Help me choose which system to run snort on. Harper, Patrick (Nov 29)
- RE: Help me choose which system to run snort on. Alex Butcher, ISC/ISYS (Nov 30)
- RE: Help me choose which system to run snort on. Harper, Patrick (Nov 30)
- RE: Help me choose which system to run snort on. Jim Richards (Nov 30)
- Re: RE: Help me choose which system to run snort on. Alex Butcher, ISC/ISYS (Nov 30)