Snort mailing list archives
Re: Snort Machines
From: "Marc Quibell" <mquibell () fbfs com>
Date: Mon, 17 Nov 2003 09:14:43 -0600
I would have to disagree. SMP kernel would make better use of two older processor vs. 1 newer processor, or even two newer processor would be best. The apps do not make much of a difference, whether they are multi-threaded or not (but I am assuming that multi-threaded apps make better use of SMP, on the thread level, not maybe so much on total processor utilization). What utilizes the SMP is the Kernel (or HAL) and it will divide the processors' time. If the app is multi-threaded, I'll have to assume the processors are divided by thread, rather than process (app). I also must add that Snort with a MySql backend: Multi-processors and MySql make MySql and much faster beast. I have two older 700MHz processors and I can fill both up just by deleting a couple hundred thousand alerts. I guess I would recommend if you have the budget, get two processors, and if not, get a multi-processor-capable board so you have room to upgrade later if you need to improve performance.
Message: 5 Date: Fri, 14 Nov 2003 16:20:47 -0500 From: "Stacy J. Brandenburg" <sbranden () redhat com> To: "'snort-users () lists sourceforge net'" <snort-users () lists sourceforge net> Subject: Re: [Snort-users] Snort Machines
From what I have seen you money is probably better used in getting a single proc system with the fastest CPU you can get. Dual CPU's depending on the setup/OS/etc does not get you anything if the application is not going to make use of it.
I am running snort on a twin 1.4GHz P3 CPU, Red Hat Enterprise Linux 2.1AS machine and only one CPU is used for snort. Now I am also pushing 750Mb/s to it and the second proc is used in handling the interrupts for the NIC.
So it really depends on how you want to use the system.
------------------------------------------------------- This SF. Net email is sponsored by: GoToMyPC GoToMyPC is the fast, easy and secure way to access your computer from any Web browser or wireless device. Click here to Try it Free! https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort Machines Friesz, Ross (Nov 14)
- Re: Snort Machines Stacy J. Brandenburg (Nov 14)
- Re: Snort Machines Duke Ionescu (Nov 14)
- <Possible follow-ups>
- Re: Snort Machines Marc Quibell (Nov 17)
- RE: Snort Machines Friesz, Ross (Nov 17)