RE: Snort as a host-based IDS

[Chris Kirby <ckirby () streetviews com>]

Fair enough! :)

I don't really have a dedicated machine available (yet, grin). But I do have
a freebsd box that is a Pentium3-750 with 128mb of ram, but it is currently
our bigrother/mrtg/syslog server. Average load times are around 0.11. 

If our bandwidth is low (under 1mb/s), how much load will Snort add to this,
especially if I want to monitor the external and DMZ segment? Are there any
problems that you can think of in Snort co-existing with BigBrother? I could
not entirely lock down the server because I need to get some ports open for
the BigBrother daemon so I'm not sure if this will be a problem or not.

I would eventually move Snort to its own server but I don't think we'll have
any money for that for some time because all of the servers are co-located
and they take up costly rackspace :)

Thanks in advance!

Chris.

-----Original Message-----
From: Fyodor [mailto:fygrave () tigerteam net]
Sent: Tuesday, October 09, 2001 4:31 PM
To: Chris Kirby
Subject: Re: [Snort-users] Snort as a host-based IDS


nope, snort is nids :)

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users