Snort mailing list archives

RE: Linux of FreeBSD


From: "Olav Langeland" <Olav.Langeland () activeisp com>
Date: Tue, 27 Nov 2001 10:48:45 +0100

From: Erek Adams [mailto:erek () theadamsfamily net]
Sent: 26. november 2001 17:16

On Mon, 26 Nov 2001, Olav Langeland wrote:
I am seeking advice on what is best suited for Snort use, Linux or
FreeBSD. It will monitor either a dual E3 link (currently at 50%
capacity) or a single port producing about 30-40Mbit. Will Debian
Linux
handle this kind of traffic without problem, or is FreeBSD a better
choice? The machine in question is P3-800, 512MB Ram and SCSI raid.

Well, you're about to get into a Holy OS War, but other than that...
Friends
don't let friends use RedHat.  :-)

Keep this fact in mind:  Run snort on _your_ OS first.  If it fails, or
drops
packets, YOU (as an admin) will see and notice that.  On stuff you
know, it's
easier to understand and fix.  Then if you can't fix it, try another
OS.
That's the long and short of it from the trenches.

Religion wars have been started for less, I know :) I was more
interested in TCP/IP performance issues than "what is the best OS" kind
of arguments, but these days it seems there isnt a huge difference after
the 2.4.x kernel.

Thanks for all the help.

-- 
Olav Langeland <> olav.langeland () activeisp com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: