Re: Quick questions about recieved packets

[Joseph Nicholson <wjnicholson () gmail com>]

I am running the following hardware:
 3.0 Ghz P4 socket 478 CPU
200 GB SATA HDD
2 GB PC 2700 RAM
 Board specs are here:
http://www.supermicro.com/products/motherboard/P4/E7210/P4SCE.cfm
 I tried sending the Alerts to a unified alert file. I took a class on
Building and Operating Snort back in March ( Thanks again Alex!!!) and
learned that the Binary output was the fastest way for Snort to process the
information since it does not have to covert it from binary to clear text
for me to read. If this would have worked I would have found a way to
convert it back to Syslog for my needs. Unfortunately I am dropping about
the same amount of packets no matter how I output the Alerts.
 Here is the interface stats. I am taking a ton of info in each second.
 GigabitEthernet0/24 is up, line protocol is down (monitoring)

5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 213264000 bits/sec, 28623 packets/sec
 I really am starting to think that I may need more than one sensor for this
segment of traffic. I am going to lower the number of ports I am monitoring
to 1 and see how that works, then go to two, and etc... until I find the
right balance for this one sensor. Currently I have 4 sensors built up for
different segments of my network. I can put all of these on this part if I
have too for testing.

  On 10/26/05, Richard Bejtlich <taosecurity () gmail com> wrote:
> Joseph Nicholson wrote:
>
> > This is my core switch and brings about 5 different network segments
> together...
> > The monitor port is a Gigabit port and the monitoring ethernet port is
> running
> > at a Gigabit also.
>
> Hi Joseph,
>
> Do you have an idea of how much bandwidth you are watching on this SPAN
> port?
>
> Can you share some specifications for your hardware -- RAM, PCI bus, etc.?
>
> Have you tried just sending alerts to an alert file, for testing?
>
> Thank you,
>
> Richard
> http://www.taosecurity.com



--
Joseph Nicholson