[Snort-users] performance snort question

Lee Smallbone lee at ...2318...
Tue Jun 19 16:43:06 EDT 2001

RW> I you use logging into MySQL, you must have a better configuration.
RW> But, yes, I think this works fine when just Snort logs into txt file.

 Not a major concern in my instance as all logging is made to a central
 MySQL server. If you intend to log locally to an SQL server, consider
 doubling the below specification, especially if you intend to also run
 something like ACID on the same box.


>> Lee Smallbone <lee at ...2318...> writes:
>> > Tuesday, June 19, 2001, 8:44:42 AM, you wrote:
>> >
>> >EHS> I haven't seen an answer to Roeland's questions so far.  I am
>> >EHS> currently considering building a snort box wich should be able to
>> >EHS> withstand a saturated 100mbps in worst-case, and have been unable to
>> >EHS> find even the slightest hint on what hardware requirement would be
>> >EHS> needed to do that.
>> >
>> >  The author seems fairly sure that a 486 should be able to keep up
>> >  with a 100mbit/s link. I'd go one step further and use the following
>> >  configuration so I know it would be there if it was needed:
>> >
>> >                o) old pentium of some sort (P90/100)
>> >                o) 32-64mb ram
>> >                o) Large disk to cope with logs (pref SCSI or ATA100)
>> >                o) Decent, trusted 100mbit/s NIC
>> Thank you very much for your answer!  I really needed this information
>> to support my push for building a snort based IDS box :)
>> /Esben
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> http://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users

RW> --
RW> Netland Internet Services
RW> bedrijfsmatige internetoplossingen

RW> http://www.netland.nl   Kruislaan 419              1098 VA Amsterdam
RW> info: 020-5628282       servicedesk: 020-5628280   fax: 020-5628281

Best regards,
 Lee                            mailto:lee at ...2318...

More information about the Snort-users mailing list