RE: Good Gbit card for Snorting?

["Abe L. Getchell" <abegetchell () home com>]

Hi Bob,
        BSD?  I mean, come on, it's not like it's the OS that Snort is
developed on or anything... Oh wait. =)  Are you going to allow the
community to provide input into the optimization process?  It seems that
one rant I always hear after an evaluation of a product is published, is
that the organization doing the testing didn't tweak <insert something
obscure here> to allow the box to burn through data a tad more quickly.
It would be really cool if you would take in some collective knowledge
from the community, as I'm sure some of the guys/gals here working in
the trenches have some interesting tricks up their sleeves...

Thanks,
Abe

--
Abe L. Getchell
Security Engineer
abegetchell () home com


> -----Original Message-----
> From: snort-users-admin () lists sourceforge net 
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of 
> Bob Walder
> Sent: Tuesday, November 13, 2001 3:43 AM
> To: abegetchell () home com
> Cc: snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Good Gbit card for Snorting?
>
>
> Abe,
>
> You get to see this twice since I forgot to cc the list the 
> first time.... d'oh!
>
> No plans to do this at present, since we have pretty much 
> settled on FreeBSD as our reference platform. The plan is to 
> build a complete box, optimised as far as possible in every 
> respect, as a sort of "proof of concept" to see how fast 
> Snort can go on a platform made up of freely available components.
>
> Regards,
>
> Bob
>
>
> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net]On Behalf Of 
> Abe L. Getchell
> Sent: 13 November 2001 01:25
> To: Bob Walder
> Cc: snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Good Gbit card for Snorting?
>
>
> Hi Bob,
>
> Any plans to benchmark the Gbit sensor on the same hardware 
> running different OS's?  It would be nice to see how the 
> multiple x86 OS's Snort runs on would perform using the same 
> hardware under the same conditions at Gbit speeds.  
> Regardless, can't wait to see the results.  Please do post a 
> note to the list when you're done as I'm sure many of us here 
> are eager.
>
> Thanks,
> Abe
>
> --
> Abe L. Getchell
> Security Engineer
> abegetchell () home com
>
>
> > -----Original Message-----
> > From: Bob Walder [mailto:bwalder () nss co uk]
> > Sent: Monday, November 12, 2001 4:24 AM
> > To: abegetchell () home com; snort-users () lists sourceforge net
> > Subject: RE: [Snort-users] Good Gbit card for Snorting?
> >
> >
> > Abe,
> >
> > Might not fit into your time scales, but we are about to build a 
> > reference platform using high-end Pentium, lots of RAM, 
> Intel Gigabit 
> > card, FreeBSD 4.4 and Snort - just to see what it can do. 
> We probably 
> > won't get around to testing it until December, however. 
> Results will 
> > be made public
> >
> > Regards,
> >
> > Bob Walder
> > Director
> >
> > The NSS Group
> > England
> >
> > Internet: http://www.nss.co.uk
> >
> >
> > -----Original Message-----
> > From: snort-users-admin () lists sourceforge net
> > [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Abe L. 
> > Getchell
> > Sent: 11 November 2001 20:50
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] Good Gbit card for Snorting?
> >
> >
> > Greetings!
> >
> > Has anyone run into a particular Gbit card which has worked 
> well for 
> > them under Linux for Snorting?  I've searched on Google, as well as 
> > other resources, and can't really come up with anything 
> except people 
> > sharing their bad experiences doing so. =)  I tend to lean towards 
> > Intel, as I've had good experiences in the past with their 10/100 
> > cards, but I thought I'd check with ya'll to see what the collective
> > community opinion was.
> >
> > Thanks,
> > Abe
> >
> > --
> > Abe L. Getchell
> > Security Engineer
> > abegetchell () home com
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe: 
> > https://lists.sourceforge.net/lists/listinfo/s> nort-users
> >
> > Snort-users list archive: 
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive: 
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive: 
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users