RE: Snort and high performance networks

["Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>]

Our 3-4Gbps system is one system with built in quad-gigE interfaces.  We
have no 10Gbps interfaces deployed (yet), as we have no need for them
(and no network pushing that kind of data yet).  The vast majority of
the time, the system is handling less than 1Gbps.  However, there are
periods of time, on a daily basis, when the threshold is neared.   

For the most part, the way we first verified these systems would handle
3-4G each was to use tcpreplay in a manner that's being discussed now by
Gary Portnoy.  Check out his most recent post.  As far as handling
30Gbps, I'm fairly certain even if it was quad-10GigE, we could NOT
handle it.  It appears from the performance of these systems that they
could probably handle closer to 5-6 Gbps... But that's just my theory. 

-----Original Message-----
From: SN ORT [mailto:snort_on_acid () yahoo com] 
Sent: Friday, May 21, 2004 1:14 PM
To: snort-users () lists sourceforge net
Cc: rafael.ortega () telecarrier com; rapier () psc edu; Kreimendahl, Chad J
Subject: RE: [Snort-users] Snort and high performance networks

Are you guys ACTUALLY running traffic at 800Mbps or
even 2-3 Gbps? I mean what application or server
process that much data on the line? This dood stated
he had an OC-whatever pumping 30Gbps, and Chad asked a
very appropriate question as to how on earth anyone
would Snort that line short of buying a machine with
an OC-3 $$ (CHA-CHING!) interface stuck in it. Most
people would use Sniffer with a WAN interface and
network fiber taps to get "quick snapshots". 

Back to the 3-4Gbps line, you have 10Gbps interfaces
deployed already? How exactly are you seeing 3-4Gbps
traffic, and is it steady and what applications use
that? I mean most switches see that kind of total 
backbone traffic and you can actually use switch-based
IDS (like the one from Cisco)...unless of course you
have a 10Gbps backbone, but to where does that much
traffic travel? 

Cheese!

Marc



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id149&alloc_id66&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users