[Snort-users] Fastest performing snort box.
Robert E. Leever
bel1 at ...358...
Wed Aug 23 19:33:23 EDT 2000
Not sure if the pentiums will give you the *most* !4$.
A sun ultra-1 model 170 with 64Megs of ram,
2G hardrive, tgx graphics card was about $3500
from ISG in Redmond, WA. in Sept of '98.
Not very fast but ...
A Sun Ultra-10 with 256M ram, 9Gig Hardrive,
floppy, cd, a 440Mhz ultra-sparc-2 prcessor
running solaris 8 is $3943.30.
includes the crt. and the pgx graphics card.
My company gets a deal on these, however...
you could probably work out something similar
with any sun reseller.
Sun has excellent warrenty support including software,
for at least 1 year, [might be longer on the ultra].
Last benchmark I saw put the ultra-sparc quite
a ways above the pentiums -- but that was some
Snort runs very well on my sparc 5 [sol 2.6] model 70,
an ultra-1 mod 170's and even a really old sparc 20
running 2.5.1 with 67 Mhz dual processors.
The sparc 5 is dog slow compared to an ultra-10.
[or even the ultra-1] but it doesn't seem to have any
problem [no dropped packets] on a class C network with
roughly 100 active systems on it. These are all 10Mbit ethernet
drops and include some randomly assigned ip addresses for the NT
systems in the shop. [maybe 40 are active at any one time].
The ultra-1 is monitoring a class C subnet with about 150 systems
on it. again, no dropped packets & that's a 100Mb subnet.
This 2nd subnet has
two E5000 NFS servers [source code, compiles & home directories]
on it so there's a lot of traffic.
The sparc-5 cpu speed is only 67Mhz and it's also my desktop system,
But...it seems to be quite a bit faster than my Intel 350Mhz Celeron Win98
at home. apples and oranges and subjective, I know... but what the heck.
Solaris 8 [source code & all] is available & that's a *real* o/s.
It's also supposed to be faster than 2.6 [but 2.6 is pretty thoroughly
debugged and has fewer security holes - especially if you don't keep/use
the dt environment.].
More information about the Snort-users