Re[2]: performance snort question

[Lee Smallbone <lee () smallbone com>]

MH> I know this doesn't pertain to the current thread exactly....but...
MH> I just got a alpha EV56 600mhz with 256megs of ram and a two(2) tulip
MH> chip set based NICs.  Does the list think that would handle 2 fully
MH> statuated 100mbs lines?  It'd be loggin to a mysql database or a .dbi
MH> file.  Think the machine will be able to handle it?

 IMO, yes.

MH> On Tue, Jun 19, 2001 at 09:43:06PM +0100, Lee Smallbone wrote:
> > RW> I you use logging into MySQL, you must have a better configuration.
> > RW> But, yes, I think this works fine when just Snort logs into txt file.
> >
> >  Not a major concern in my instance as all logging is made to a central
> >  MySQL server. If you intend to log locally to an SQL server, consider
> >  doubling the below specification, especially if you intend to also run
> >  something like ACID on the same box.
> >
> > /Lee
> >
> > > > Lee Smallbone <lee () smallbone com> writes:
> > > >
> > > > > Tuesday, June 19, 2001, 8:44:42 AM, you wrote:
> > > > >
> > > > > EHS> I haven't seen an answer to Roeland's questions so far.  I am
> > > > > EHS> currently considering building a snort box wich should be able to
> > > > > EHS> withstand a saturated 100mbps in worst-case, and have been unable to
> > > > > EHS> find even the slightest hint on what hardware requirement would be
> > > > > EHS> needed to do that.
> > > > >
> > > > >  The author seems fairly sure that a 486 should be able to keep up
> > > > >  with a 100mbit/s link. I'd go one step further and use the following
> > > > >  configuration so I know it would be there if it was needed:
> > > > >
> > > > >                o) old pentium of some sort (P90/100)
> > > > >                o) 32-64mb ram
> > > > >                o) Large disk to cope with logs (pref SCSI or ATA100)
> > > > >                o) Decent, trusted 100mbit/s NIC
> > > >
> > > > Thank you very much for your answer!  I really needed this information
> > > > to support my push for building a snort based IDS box :)
> > > >
> > > > /Esben
> > > >
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or unsubscribe:
> > > > http://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > RW> --
> > RW> Netland Internet Services
> > RW> bedrijfsmatige internetoplossingen
> >
> > RW> http://www.netland.nl   Kruislaan 419              1098 VA Amsterdam
> > RW> info: 020-5628282       servicedesk: 020-5628280   fax: 020-5628281
> >
> >
> >
> >
> > Best regards,
> >  Lee                            mailto:lee () smallbone com
> >
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
MH> Mitchell Henderson                      mitchell () cts wustl edu



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users