Re: Sizing of a box requiring 2x10Gbps

[JJC <cummingsj () gmail com>]

You may end up capturing the traffic and then replaying it back at a rate
that you can analyze an acceptable percentage of the traffic.. say, 100%  Of
course you may have problems with storage and also not capturing 100% of the
traffic.

On Wed, Jul 7, 2010 at 5:18 AM, Joel Esler <jesler () sourcefire com> wrote:

> It would be very difficult to achieve those kinds of speeds without a
> commercial Snort appliance like Sourcefire.
>
> Sorry for the plug.
>
> --
> Sent from my iPad
>
> On Jul 7, 2010, at 4:28 AM, "Sven Juergensen (KielNET)" <
> s.juergensen () kielnet de> wrote:
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Hi list,
> >
> > I'm playing with the thought of implementing an
> > IDS for our network. Now, for the box handling
> > this, a bit of advice would be appreciated. It
> > needs 2 10GE interfaces and would have to soak
> > up a throughput of about 4GBps tops. The amount
> > of accumulated data should last about a week.
> >
> > Does anyone know the rough specs for a box to
> > deal with this?
> >
> > Thanks in advance and regards,
> >
> > Mit freundlichen Gruessen,
> >
> >       i. A. Sven Juergensen
> >
> > - --
> > Fachbereich
> > Netze und Rechenzentren
> >
> > KielNET GmbH
> > Gesellschaft fuer Kommunikation
> > Preusserstr. 1-9, 24105 Kiel
> >
> > Telefon : 0431 2219-053
> > Mobil   : 0170 403 5600
> > Telefax : 0431 2219-005
> > E-Mail  : s.juergensen () kielnet de
> > Internet: http://www.kielnet.de
> >
> > Geschaeftsfuehrer Eberhard Schmidt
> > HRB 4499 (Amtsgericht Kiel)
> >
> > PGP details at
> > http://pgp.kielnet.de/sjuergensen/
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
> >
> > iEYEARECAAYFAkw0Or0ACgkQnEU7erAt4TLYvQCgro8f56KLyt6QH4gSql4GO8CS
> > c+8AoPJfbeK3Ft+jgqmv3gFih7K41tkw
> > =8R2s
> > -----END PGP SIGNATURE-----
> ------------------------------------------------------------------------------
> > This SF.net email is sponsored by Sprint
> > What will you do first with EVO, the first 4G phone?
> > Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users