[Snort-users] performance snort question

Lee Smallbone lee at ...2318...
Tue Jun 19 18:11:08 EDT 2001


MH> I know this doesn't pertain to the current thread exactly....but...
MH> I just got a alpha EV56 600mhz with 256megs of ram and a two(2) tulip
MH> chip set based NICs.  Does the list think that would handle 2 fully
MH> statuated 100mbs lines?  It'd be loggin to a mysql database or a .dbi
MH> file.  Think the machine will be able to handle it?

 IMO, yes.

MH> On Tue, Jun 19, 2001 at 09:43:06PM +0100, Lee Smallbone wrote:
>> RW> I you use logging into MySQL, you must have a better configuration.
>> RW> But, yes, I think this works fine when just Snort logs into txt file.
>>
>>  Not a major concern in my instance as all logging is made to a central
>>  MySQL server. If you intend to log locally to an SQL server, consider
>>  doubling the below specification, especially if you intend to also run
>>  something like ACID on the same box.
>>
>> /Lee
>>
>> >>
>> >> Lee Smallbone <lee at ...2318...> writes:
>> >>
>> >> > Tuesday, June 19, 2001, 8:44:42 AM, you wrote:
>> >> >
>> >> >EHS> I haven't seen an answer to Roeland's questions so far.  I am
>> >> >EHS> currently considering building a snort box wich should be able to
>> >> >EHS> withstand a saturated 100mbps in worst-case, and have been unable to
>> >> >EHS> find even the slightest hint on what hardware requirement would be
>> >> >EHS> needed to do that.
>> >> >
>> >> >  The author seems fairly sure that a 486 should be able to keep up
>> >> >  with a 100mbit/s link. I'd go one step further and use the following
>> >> >  configuration so I know it would be there if it was needed:
>> >> >
>> >> >                o) old pentium of some sort (P90/100)
>> >> >                o) 32-64mb ram
>> >> >                o) Large disk to cope with logs (pref SCSI or ATA100)
>> >> >                o) Decent, trusted 100mbit/s NIC
>> >>
>> >> Thank you very much for your answer!  I really needed this information
>> >> to support my push for building a snort based IDS box :)
>> >>
>> >> /Esben
>> >>
>> >> _______________________________________________
>> >> Snort-users mailing list
>> >> Snort-users at lists.sourceforge.net
>> >> Go to this URL to change user options or unsubscribe:
>> >> http://lists.sourceforge.net/lists/listinfo/snort-users
>> >> Snort-users list archive:
>> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>
>> RW> --
>> RW> Netland Internet Services
>> RW> bedrijfsmatige internetoplossingen
>>
>> RW> http://www.netland.nl   Kruislaan 419              1098 VA Amsterdam
>> RW> info: 020-5628282       servicedesk: 020-5628280   fax: 020-5628281
>>
>>
>>
>>
>> Best regards,
>>  Lee                            mailto:lee at ...2318...
>>
>>
>>
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> http://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
MH> Mitchell Henderson                      mitchell at ...2338...






More information about the Snort-users mailing list