Re: High-Performance Installation Reccomendations for Snort?

[Jon Ottar Runde <jorunde () broadpark no>]

On to , 2002-03-28 at 19:26, Ryan Hill wrote:
> All,
>
> After spending quite some time with an extremely stable RH 7.2, snort,
> mysql, apache and demarc combination with two sensors, I've decided that I'd
> like to expand my sensor network to between 4 and 6 sensors (migrating to a
> new machine) running on a low to moderately busy 10/100 switched network.  
>
> Because of this, I fear that Linux may not be able to keep up with the
> overhead and stay running smoothly, so I'm soliciting opinions from the list
> (in public or private) on your reccomendations for an optimum server
> configuration.
>
> Planned Hardware Specs
> PIII 933
> 384 MB RAM
> 40 GB ATA 100 IDE
> 1 Intel NIC (on-board)
> 2 Quad Ethernet Port PCI Cards

Why do you think that linux may not be able to keep up?

I would try it first, if I were you. RH 7.2 w/updates (kernel 2.4.9-31)
is extremely stable here, -running snort and ntop on 4-5 100/switched
interfaces. I do have 2 CPUs and SCSI, and that might help with
performance....


Jon O


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users