Re: HW Specs

["Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>]

--On 23 November 2005 11:59 +0000 "Alex Butcher, ISC/ISYS" 
<Alex.Butcher () bristol ac uk> wrote:

> The sensor is currently monitoring a single 100Mbit (pretty much solid,
> 24x7) feed from a SPAN port and has all rules enabled (including bleeding
> and community), with a fair bit of session tagging, and is utilizing
> 15-30% of one CPU and 188Mbyte of memory to do so. Snort is linked
> against Phil Wood's modified libpcap and configured to use the maximum
> buffer size. Hopefully the CPU usage will decrease once I've had a chance
> to tune the rules properly.

A quick correction; I thought my statistics were lying to me, but 
apparently, the sensor has a single Gbit feed, rather than the single 
100Mbit feed I was referring to in my original post above.

There is currently some packet loss, but I'm not quite sure at the moment 
whether it's the switch, the sensor hardware, the sensor->console link, or 
running on x86_64 that is causing this. My guess is the switch, but I've 
not verified this yet.

> Alex.

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users