Re: "Making Snort go fast under Linux..."

[Ronny Vaningh <ronny () netrusion com>]

>   
> > You mentioned performance may be enhanced by using different
> > compilers/flags. I'm going to run some tests using different setups (OS,
> > compiler collection, etc). Can anybody suggest an ideal way to beat the
> > Hell out of a Snort box?
> >
> >
> >     
>
> First thing that comes to mind:
> http://www.breakingpointsystems.com/
> Though I have no experience with the product, Im just aware of it :)
>
>   
I do have experience with the product and altough it's good, it comes at 
a very heavy price tag.
Since the original poster claims he has spend an obscene amount of money 
at a quad core PC for his lab, i'm afraid that it's above his price league.

In the past I have tested with a combo of pcap replay, and stimulus 
traffic generated by some perl scripts which were emulating clients and 
making request to real targets.

This will give you an idea and you can even get upto a certain level of 
comparison between products.
your results will however not be widely accepted.


<shameless plug>
you can contact me also off list and I can get someone to make you an 
offer for commercial performance testing ...
<shameless plug>



Happy testing


Ronny

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users