RE: Re: Snort on large loads.

["Robert D. Hughes" <rob () robhughes com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Well, not really. Sniffing packets off the interface and sniffing
packets off the interface, then reassembling streams, looking at the
state, comparing the traffic to a series of signatures, decoding any
uni-code encoding before checking, and etc. are really two very
different levels of work.

- -----Original Message-----
From: Wedge Breaker [mailto:wedgebreaker () crackdealer com]
Sent: Wednesday, December 12, 2001 8:46 AM
To: goemon () anime net
Cc: snort-users () lists sourceforge net
Subject: RE: Re: [Snort-users] Snort on large loads.


Come now - that's just a crutch.  If tcpdump can keep up with this
traffic (which it does), then the hardware isn't an issue.  Do you KNOW
that upgrading to better hardware will solve my problem, or is this just
a common-sense suggestion?  As far as I know, both Sourcefire and
Intrusion.com both use systems that are roughly comparable to the box I
was using.

Just to placate the masses, I'm going to get back into the testing arena
again and run snort on a monster box (1.1 GHz w/ 512M RAM and 64-bit PCI
bus) to see what happens.

wb

> Date: Tue, 11 Dec 2001 12:50:46 -0800 (PST)
> "..." <goemon () anime net> Wedge Breaker
<wedgebreaker () crackdealer com>cc: <snort-users () lists sourceforge net>
> Re: [Snort-users] Snort on large loads.
> On Tue, 11 Dec 2001, Wedge Breaker wrote:
> > and then.  This is a PIII 800-something w/ 256M RAM and rocking Intel

> > Gig card so it's no slouch in the hardware department.
>
> Thats a relatively slow box these days. Try a newer athlon with pc2100
ddr 
> ram and 64bit pci slots
>
> -Dan
> -- 
> [-] Omae no subete no kichi wa ore no mono da. [-]


- ------------------------------------------------------------
[- Get your own free e-mail @ http://www.crackdealer.com -]

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQA/AwUBPBd2Y+a2P6TrxG1EEQJBMQCdEydMsIoE0dyY/3f1IRBxW5TJrp8AoLUg
KvecMYJHkVzux+rRspPq6Qgf
=TYhV
-----END PGP SIGNATURE-----


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users