Re: hardware requirements

["Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>]

--On 09 January 2005 15:21 -0800 Jeffery Martin <jmartin () yipes com> wrote:

> Greetings, I would like to know if anyone has any hardware
> recommendations to run SNORT on. specifically im looking to put a GigE
> NIC in a box and would like to know how fast a CPU and memory etc etc.

I've not bought hardware yet, but I'm going to be putting in a purchase 
order for a couple of substantial systems (i.e. Xeons or Opterons) based on 
the Sourcefire specs (e.g. 
<http://217.160.73.131/preise/NOXS%20preisliste_SF.PDF>). Note that 
Sourcefire uses barnyard by default, and didn't use the Bleeding-Edge rules 
last I saw.

I plan to throw a couple of Intel quad port PCI-X Gbit NICS in the sensor 
and have it monitor more and more segments until it collapses from the 
load. Until I have a good understanding of how much 'oomph' is required for 
a given network load, I figure this is cheaper and less wasteful than 
wildly over-spec'ing a one-or-two segment sensor, or wildly under-spec'ing 
by attempting to use a PCI Celeron machine...

> Jeff Martin III

HTH,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users