[Snort-users] performance snort question
lee at ...2318...
Tue Jun 19 16:43:06 EDT 2001
RW> I you use logging into MySQL, you must have a better configuration.
RW> But, yes, I think this works fine when just Snort logs into txt file.
Not a major concern in my instance as all logging is made to a central
MySQL server. If you intend to log locally to an SQL server, consider
doubling the below specification, especially if you intend to also run
something like ACID on the same box.
>> Lee Smallbone <lee at ...2318...> writes:
>> > Tuesday, June 19, 2001, 8:44:42 AM, you wrote:
>> >EHS> I haven't seen an answer to Roeland's questions so far. I am
>> >EHS> currently considering building a snort box wich should be able to
>> >EHS> withstand a saturated 100mbps in worst-case, and have been unable to
>> >EHS> find even the slightest hint on what hardware requirement would be
>> >EHS> needed to do that.
>> > The author seems fairly sure that a 486 should be able to keep up
>> > with a 100mbit/s link. I'd go one step further and use the following
>> > configuration so I know it would be there if it was needed:
>> > o) old pentium of some sort (P90/100)
>> > o) 32-64mb ram
>> > o) Large disk to cope with logs (pref SCSI or ATA100)
>> > o) Decent, trusted 100mbit/s NIC
>> Thank you very much for your answer! I really needed this information
>> to support my push for building a snort based IDS box :)
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> Snort-users list archive:
RW> Netland Internet Services
RW> bedrijfsmatige internetoplossingen
RW> http://www.netland.nl Kruislaan 419 1098 VA Amsterdam
RW> info: 020-5628282 servicedesk: 020-5628280 fax: 020-5628281
Lee mailto:lee at ...2318...
More information about the Snort-users