Snort on large loads

[Don Heffernan <donheff () cais net>]

I use Snort at home and have been impressed with what I read about what 
"real" folks are doing with it on this list.  I sent my firewall guy at 
work an article I saw referenced on Slashdot.  Here is his question:
"...I am wondering about the ability of Snort to keep up with big loads, 
such as approaching 45 Megabits (downwind from a T3) on a FastEthernet 
or GigE segment.  I understand there are products out there that may be 
much more comprehensive than NFR or RealSecure, but I am not sure that 
Snort can scale to such loads (It may depend on the hardware you throw 
at it though..)  Any ideas on performance factors before Snort goes into 
what they are calling "sampling mode"  .."

Does anyone have answers I can share with him?  ---

--
Don Heffernan
heffernan.cais.net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users