Re: Snort Hardware Requirements

[Mike Miller <mike () millertwinracing com>]

I'm doing a similar analysis, but am coming to a different conclusion. 

First off, how much bandwidth are you looking at?

Second, do you REALLY NEED the entire ruleset?

Third, properly specifying the hardware produces good dividends. 

Fourth, what are you doing with the results, and how long are you looking to keep them?

I have a dl585G2 that's handling 800 mpbs with about a 7% drop rate. It's got 8 cores and 32 gb RAM. I suspect I could 
double that with a NIC that supports PF_ring in hardware, triple it if I made some concessions in the ruleset (I don't 
care if you're using MSN chat).

The replacement hardware will be a 8 slot shelf with a san, a dedicated blade for IDS, and another blade or two doing 
VMware'y things. I'm estimating two of these at a negotiated price around $40k a piece. They'll be sized to handle 10 
gig per location, with some futureproofing in the chassis. 




On Apr 25, 2013, at 6:44 AM, "Soranno, Robert T." <Robert.Soranno () jhuapl edu> wrote:

> Hi!
>
> I'm trying to prepare a tradeoff analysis regarding hardware necessary to fully install Snort, its  per-processors 
> and third party software.  I have been informed that the entire Snort install can require up to 4 blades.  Is there a 
> document posted listing the memory and CPU requirements of all components so that I could pick/choose the 
> per-processors, etc. to accommodate my needs and know how much real estate is necessary?
>
> Thanks.
> ------------------------------------------------------------------------------
> Try New Relic Now & We'll Send You this Cool Shirt
> New Relic is the only SaaS-based application performance monitoring service 
> that delivers powerful full stack analytics. Optimize and monitor your
> browser, app, & servers with just a few lines of code. Try New Relic
> and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!