[Snort-users] Snort performance

Simon Attwell attwell at ...460...
Sat Mar 31 12:43:25 EST 2001

Has anyone done any performance trending for snort ?

i.e. has any kept a track of the amount of traffic that a single snort 
instance can handle
with respect to a) the cpu b) memory and c) OS.

I have an implementation that requires me to watch constantly high traffic 
levels and i'm trying to guess
at the sort of horsepower i need to throw at the problem.

Traffic is constantly between 20 and 60 Mbps, and at present I'm watching a 
129 C's as $HOME_NET
with a complete ruleset (trimmed of things i dont care about).

I'm thinking Dual 933Mhz PIII with 512 Mb of RAM and a couple of Intel 
EtherExpress PRO 100 NIC's.
The box will be running two instances of snort (on 2 different interfaces) 
which is why i spec dual cpu's

         - Simon

Simon Attwell
Systems Engineer
5520 Research Park Drive
Madison, WI 53711
attwell at ...460...

Berbee... putting the E in business

More information about the Snort-users mailing list