[Snort-users] performance snort question

Esben Haabendal Soerensen esben at ...2316...
Tue Jun 19 06:52:46 EDT 2001


Lee Smallbone <lee at ...2318...> writes:

> Tuesday, June 19, 2001, 8:44:42 AM, you wrote:
> 
>EHS> I haven't seen an answer to Roeland's questions so far.  I am
>EHS> currently considering building a snort box wich should be able to
>EHS> withstand a saturated 100mbps in worst-case, and have been unable to
>EHS> find even the slightest hint on what hardware requirement would be
>EHS> needed to do that.
> 
>  The author seems fairly sure that a 486 should be able to keep up
>  with a 100mbit/s link. I'd go one step further and use the following
>  configuration so I know it would be there if it was needed:
> 
>                o) old pentium of some sort (P90/100)
>                o) 32-64mb ram
>                o) Large disk to cope with logs (pref SCSI or ATA100)
>                o) Decent, trusted 100mbit/s NIC

Thank you very much for your answer!  I really needed this information
to support my push for building a snort based IDS box :)

/Esben




More information about the Snort-users mailing list