Snort mailing list archives
Re: HW Specs
From: Gulfie <gulfie () grotto-group com>
Date: Tue, 22 Nov 2005 13:42:44 -0800
On Mon, Nov 21, 2005 at 09:14:41AM -0500, Rich Moffitt wrote:
I'm not an everyday snort user lately, but I think there are a couple of questions we need to ask: 1) What kinds of rules do you plan on using on this traffic? (It'll affect your processing needs) 2) You're on a 100Mbit switch, yet each interface will see 17 and 14GB of traffic, respectively? I'm confused. What's the peak data rate going through each interface? (Obviously not above 100Mbit) 3) What kind of logging do you intend on doing? Are you concerned about having enough storage for this sensor?
More questions: 4) What OS are you planning on running? Some Recomendations: a) Get some nice gigabit Nics. Intel E1000s come to mind. Sure you may not need gigabit, but the gigabit cards deal with traffic much better than there slower breathren. Even the 32 bit version will be a good start. -gulfie
Regards, Rich Brian J. Dyrehauge wrote:Hey Snort Users! I'm about to buy some hardware, and need to know what specs to go with. I'll be using Snort and MySQL on the same machine. We'll be monitoring on 2 NICs. Net traffic will be, as far as I've been informed by our customer, 17 GB on one NIC and 14 GB on the other NIC. The switch is a 100 MB, which means no Gigabit traffic. Do you guys have any recommendations as to what hardware I should buy? Take into consideration that it has to be non-expensive. ;) Yours sincerely, Brian------------------------------------------------------- This SF.Net email is sponsored by the JBoss Inc. Get Certified Today Register for a JBoss Training Course. Free Certification Exam for All Training Attendees Through End of 2005. For more info visit: http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by the JBoss Inc. Get Certified Today Register for a JBoss Training Course. Free Certification Exam for All Training Attendees Through End of 2005. For more info visit: http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- HW Specs Brian J. Dyrehauge (Nov 21)
- Re: HW Specs Rich Moffitt (Nov 21)
- Re: HW Specs Gulfie (Nov 22)
- Re: HW Specs Alex Butcher, ISC/ISYS (Nov 23)
- Re: HW Specs Alex Butcher, ISC/ISYS (Nov 28)
- <Possible follow-ups>
- RE: HW Specs Timothy A. Holmes (Nov 23)
- RE: HW Specs Alex Butcher, ISC/ISYS (Nov 24)
- Re: HW Specs Rich Moffitt (Nov 21)