Re: Snort Sensor Hardware

[Jason Alexander <lists () itsecurity3 its uiowa edu>]

Matt Kettler wrote:

> At 03:59 PM 12/10/2003, SRH-Lists wrote:
>
>> For 1U rackmount boxes pre-installed with linux (several flavor options)
>> or {Net,Free,Open}BSD, check out
>> http://www.ironsystems.com
>>
>> Much cheaper than the Dell 1U's.
>
>
>
> They are?
>
> The closest match I could configure is:
>
> dell poweredge 650 2.4g p4, floppy, cdrom, 40g ide, 256m, redhat, 
dual gig-e
> $1168
>
> Iron systems A220 2.4g p4,  no floppy, cdrom, 40g ide,256m, redhat, 
dual 100mbit (no gig-e)
> $1,008.80 (one gig-e available for +$127)
>
> The A160 can be made to have 2 gig-e's but that's more expensive, but 
you wind up with more hardware - 4 ethernet interfaces: 2 10/100, 2 
10/100/1000.
> That one comes in at $1,210.40 for the same basic config, but with 2 
onboard 10/100's 1 onboard gig-e, and 1 pci-slot gig-e.
>
> Really I'd see Iron systems as having the advantage in different OS 
configs, ie: offering BSD's and linux, but the price difference is 
pretty negligible for same-class hardware. (they do offer much lower end 
hardware though)
>


Just looking at the configs I'm not sure.  One thing that I was looking 
for was 64bit PCI. I would think in a snort sensor that would be one of 
the things that you would want to have the most.  Since we don't plan on
storing any of the data on the sensors I don't much care about disk 
speed or size.  I only need one Gig-E interface for sure and can 
probably get away with a 10/100 for the connection to the database.


I guess the better questions is that since there are hundreds of 1U 
vendors out there what typically hardware are people using.  Like
I mentioned before I will be using Gig-E interface but really only
looking at most 40Mbit/s of traffic.

Jason




-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users