Snort mailing list archives
RE: Snort capacity planning help
From: "Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>
Date: Thu, 7 Aug 2003 12:22:59 -0500
Yes. Depends on the system. Your needs shouldn't be a problem for any new system you buy. The limitations on how much data a sensor/snort can handle are usually hardware/OS related. I recommend making sure your gig-e interface (whether it be built in or a card) have drivers that will do polling in the kernel of your choice (Linux?). Your best bet is to do some reading on the net (read: Google) about network performance improvements for your kernel and/or potential network device. As an aside, I've seen several gigabits pushed across a system costing less than $4k. Yes, with stream4 and other preprocs on. -----Original Message----- From: Sheahan, Paul [mailto:Paul.Sheahan () priceline com] Sent: Thursday, August 07, 2003 12:00 PM To: Snort List (E-mail) Subject: RE: [Snort-users] Snort capacity planning help To simplify my original question: Is anyone running Snort on gig Ethernet? Under stress how high of traffic in mb/s can you go before Snort starts dropping packets? Thanks -----Original Message----- From: Sheahan, Paul [mailto:Paul.Sheahan () priceline com] Sent: Wednesday, August 06, 2003 4:30 PM To: Snort List (E-mail) Subject: [Snort-users] Snort capacity planning help Hello, We're currently redesigning portions of our network with higher capacity equipment and I need to plan new Snort builds. We currently have a 100mb/s network and have up to 40mb/s traffic. Snort 1.9 on Linux currently handles this fine. We plan to switch to 1000mb/s (gig) network and expect traffic to double (give or take). Can anyone tell me.....can Snort handle this configuratrion and what limitations does Snort have when it comes to network throughput, CPU etc? I want to make sure I buy the right hardware for my new Snort box and want to be able to handle much higher traffic loads then we expect. Any tips, references, caveats etc would be great. Thanks! Paul Sheahan Information Security Manager priceline.com ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort capacity planning help Sheahan, Paul (Aug 06)
- <Possible follow-ups>
- RE: Snort capacity planning help Sheahan, Paul (Aug 07)
- RE: Snort capacity planning help Kreimendahl, Chad J (Aug 07)