[Snort-users] performance snort question

Roeland Weve roeland at ...1415...
Tue Jun 19 07:44:13 EDT 2001


I you use logging into MySQL, you must have a better configuration.
But, yes, I think this works fine when just Snort logs into txt file.

> 
> Lee Smallbone <lee at ...2318...> writes:
> 
> > Tuesday, June 19, 2001, 8:44:42 AM, you wrote:
> >
> >EHS> I haven't seen an answer to Roeland's questions so far.  I am
> >EHS> currently considering building a snort box wich should be able to
> >EHS> withstand a saturated 100mbps in worst-case, and have been unable to
> >EHS> find even the slightest hint on what hardware requirement would be
> >EHS> needed to do that.
> >
> >  The author seems fairly sure that a 486 should be able to keep up
> >  with a 100mbit/s link. I'd go one step further and use the following
> >  configuration so I know it would be there if it was needed:
> >
> >                o) old pentium of some sort (P90/100)
> >                o) 32-64mb ram
> >                o) Large disk to cope with logs (pref SCSI or ATA100)
> >                o) Decent, trusted 100mbit/s NIC
> 
> Thank you very much for your answer!  I really needed this information
> to support my push for building a snort based IDS box :)
> 
> /Esben
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Netland Internet Services
bedrijfsmatige internetoplossingen

http://www.netland.nl   Kruislaan 419              1098 VA Amsterdam
info: 020-5628282       servicedesk: 020-5628280   fax: 020-5628281




More information about the Snort-users mailing list