Snort mailing list archives

AW: 3 or 4 NICs in a sensor?


From: "Poppi, Sandro" <Sandro.Poppi () wacker com>
Date: Sat, 28 Sep 2002 11:05:20 +0200

Ben,

could you be a little more specific about the probs you've had with DLink
DFE 570TX? I'm using it in 2 boxes and don't see any probs yet.

Thanks,
Sandro

Beware of the bargain priced 4-port cards, you may get what 
you pay for.
For normal operation, they usually work fine, but promisc can be
troublesome.  Personally, I've had bad experiences with 
running Snort on
the D-Link DFE-570TX 4-port NICs.  They are awfully cheap ( < $200),
however.

On the other hand, I've had all good experiences with using 
Intel PRO/100
S 2-port NICs.  Not cheap, but rock solid.  If you have the funds, a
couple of those cards would do nicely.  They have good Linux support
through either Intel's e100 driver or Donald Becker's eepro driver.
Others may disagree with me, but I'd recommend using the e100 
driver w/
this particular card.  I think kernel 2.4.19 is now including 
a version of
the Intel e100 driver.

Hope this helps,
Ben

On Fri, 27 Sep 2002, Erek Adams wrote:

Short answer:  Yes, do it.

Longer answer:  Works like a charm.  One other thing that 
you might want to
consider is to use a quad port card.  One slot, but 4 
ports.  I'm not sure on
pricing, but the Sun QFE used to be around $1200.  I'm sure 
you can get one
cheaper than that.  I'm sure if you check websites you can 
find a good deal on
them...

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: