[Snort-users] sizing a snort ids system?

Dragos Ruiu dr at ...50...
Thu Aug 10 17:15:27 EDT 2000

On Thu, 10 Aug 2000, John Horn wrote:
> We operate Snort on our T3 (45Mb/s) with a dual processor 500Mhz
> Compaq Proliant rack mount, 128MB RAM and an 18GB RAID 5 disk
> subsystem. It has absolutely no difficulty in keeping up. I still
> think I would prefer a moderately beefy Sun though. I would have had
> to order the Sun though, the Compaq was already here in a box waiting
> for someone to assign it a role in life...

Dual P2 400s FBSD with 128-768Mb regularly handle in excess of 60Mbps
saturated steady state load (admittedly big packet though) with less than 2% 
packet loss long term and similar loss short term (important distinction!).

RAM can buy you a lot of long burst survivability which is a huge win IMHO.
I've got one big ram system, and I don't have the patience to try to make
it lose packets.


dursec.com ltd. / kyx.net - we're from the future    http://www.dursec.com

More information about the Snort-users mailing list