Re: Re: [Snort-users] Running SNORT in low end device

[aravind babu <aravindforsnort () yahoo co in>]

Hi all,
  
  
          Thanks for the replies.
  I am trying to put the SNORT-INLINE code and rule database in NAND flash.My NAND flash size is 32MB.
  I am using micro controller linux.So there is no question of swapping Terry.
  
  For Gulfie question :
  My processor is MIPS based and speed is 177MHz.Great to your memory power.
  
  How much memory is required to run Snort-inline ?
  
  Thanks in advance,
  Aravind.
  
  

Jason <security () brvenik com> wrote:  Try playing with these settings

use lowmem for pattern matcher
use small stream flush intervals
reduce stream memory
reduce frag memory
reduce flow memory
reduce flowbits
reduce flow depth for http_inspect
reassemble client only streams
turn off the bo preprocessor
turn off portscan
turn off a bunch of rules that you probably do not need

With such low memory usage you will likely hit a point of thrashing if
you try to handle anything more than a few systems using 1M of pipe but
it would work for a home system ok.


Terry Vernon wrote:
> I run a similar setup you mentioned with a Pentium 2 266mhz, over 320MB of
> ram.
>
> My snort usually is hogging up 71MB on my 10/100 home network, which is a
> bridge. That all runs great but you're asking for a lot out of 64MB. You
> could try to get by on swap space if your hard disk is decent.
>
> You can do this if you find a way to expand the memory. If you can't and you
> want to be McGyver about the idea you could try to put your swap partition
> on the faster accessing flash memory. Try to log to the slower hard drive.
>
> -Terry
>
> -----Original Message-----
> From: snort-devel-admin () lists sourceforge net
> [mailto:snort-devel-admin () lists sourceforge net] On Behalf Of Gulfie
> Sent: Monday, December 19, 2005 8:38 AM
> To: aravind babu
> Cc: snort-users () lists sourceforge net; snort-devel () lists sourceforge net
> Subject: [Snort-devel] Re: [Snort-users] Running SNORT in low end device
>
> On Mon, Dec 19, 2005 at 12:29:40PM +0000, aravind babu wrote:
>
> > Hi all,
> >
> >
> >       I am planning to run Snort/Snort-Inline on the
> > following Hardware configuration.
> >
> >
> >       Processor  : 177MHz
> >       RAM        :  64MB
> >       NAND FLASH : 128MB  (Where Snort code will
> > exist.Also signatures)
>
>  
>  
>  Okay.
>
>  What processor?  Is it a i386 based procesosr, or some wierd arm
> embedded thing, or the 
> MIPS thing you were working on in Dec 2003? 
>
>  
>
> > Is it worth to do this?I am planning to build a
> > appliance which will have functionalities of
> > Firewall,VPN,and IDS/IPS.
>
>
>
>  But the question is why? and where are you going to put it?
>
>  It could be a wonderfull solution, or a very bad solution depending
> on the problems that are
> being addressed.
>  
>   
>  
>
> > Please tell me your views on this.
>
>
>  Snort without rules, is about 8 Megabytes in core (on the machine
> sitting before me), with the default 
> ruleset it's up to 40 Megabytes, and with the VRT_PR rules, community rules
> and Bleeding edge snort rules, you're 
> up to maybe 60 Megabytes. 
>
>  So you'r going to have to config the ruleset way way down, same
> thing for the preprocessors.
>
>  Other interesting questions.  Where are the alerts going to go?
> Back down the vpn connection? 
>
>  You'll be able to do it, just make sure that your expectations are
> set correctly.  177MHz is _reallly_ slow, and 64 MB is _really_ small.   If
> you are looking to IDS/IPS over a modem vpn connection, it'll probibly be
> fast enough.  If you are looking to IDS/IPS over a 10/100 ethernet
> port(s)... The answer is probibly not as much. 
>
>
>  
>  That being said.  It could be a nifty little device, to send along
> with peoples laptops
> as a network condom.  
>
>
>       -gulfie
>  
>
> > Thanks in advance,
> > Aravind.
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel



Send instant messages to your online friends http://in.messenger.yahoo.com