[Snort-devel] Re: [Snort-users] Running SNORT in low end device

Terry Vernon tvernon24 at ...2251...
Mon Dec 19 09:39:03 EST 2005

I run a similar setup you mentioned with a Pentium 2 266mhz, over 320MB of

My snort usually is hogging up 71MB on my 10/100 home network, which is a
bridge. That all runs great but you're asking for a lot out of 64MB. You
could try to get by on swap space if your hard disk is decent.

You can do this if you find a way to expand the memory. If you can't and you
want to be McGyver about the idea you could try to put your swap partition
on the faster accessing flash memory. Try to log to the slower hard drive.


-----Original Message-----
From: snort-devel-admin at lists.sourceforge.net
[mailto:snort-devel-admin at lists.sourceforge.net] On Behalf Of Gulfie
Sent: Monday, December 19, 2005 8:38 AM
To: aravind babu
Cc: snort-users at lists.sourceforge.net; snort-devel at lists.sourceforge.net
Subject: [Snort-devel] Re: [Snort-users] Running SNORT in low end device

On Mon, Dec 19, 2005 at 12:29:40PM +0000, aravind babu wrote:
> Hi all,
>        I am planning to run Snort/Snort-Inline on the
> following Hardware configuration.
>        Processor  : 177MHz
>        RAM        :  64MB
>        NAND FLASH : 128MB  (Where Snort code will
> exist.Also signatures)

	What processor?  Is it a i386 based procesosr, or some wierd arm
embedded thing, or the 
MIPS thing you were working on in Dec 2003? 

> Is it worth to do this?I am planning to build a
> appliance which will have functionalities of
> Firewall,VPN,and IDS/IPS.

	But the question is why? and where are you going to put it?

	It could be a wonderfull solution, or a very bad solution depending
on the problems that are
being addressed.
> Please tell me your views on this.

	Snort without rules, is about 8 Megabytes in core (on the machine
sitting before me), with the default 
ruleset it's up to 40 Megabytes, and with the VRT_PR rules, community rules
and Bleeding edge snort rules, you're 
up to maybe 60 Megabytes. 

	So you'r going to have to config the ruleset way way down, same
thing for the preprocessors.

	Other interesting questions.  Where are the alerts going to go?
Back down the vpn connection? 

	You'll be able to do it, just make sure that your expectations are
set correctly.  177MHz is _reallly_ slow, and 64 MB is _really_ small.   If
you are looking to IDS/IPS over a modem vpn connection, it'll probibly be
fast enough.  If you are looking to IDS/IPS over a 10/100 ethernet
port(s)... The answer is probibly not as much. 

	That being said.  It could be a nifty little device, to send along
with peoples laptops
as a network condom.  

> Thanks in advance,
> Aravind.

This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
Snort-devel mailing list
Snort-devel at lists.sourceforge.net

More information about the Snort-devel mailing list