[Snort-users] What does lightweight mean?
Talisker at ...423...
Thu May 31 13:22:01 EDT 2001
The term "lightweight" is referring to the minimal resources used by Snort,
whilst a common misconception the term does not reflect Snorts performance
as an IDS.
Talisker's Network Security Tools List
Security Tools Notification
----- Original Message -----
From: "Anderson, Bill" <wander01 at ...2144...>
To: "'Snort Users'" <snort-users at lists.sourceforge.net>
Sent: Wednesday, May 30, 2001 3:19 PM
Subject: [Snort-users] What does lightweight mean?
> I have been considering Snort as an IDS for our organization, but several
> people have tried to steer me away because Snort is described as
> 'lightweight.' What does the term lightweight mean or imply? Does it mean
> can only handle light network traffic streams, or does it mean it is light
> in terms of needed resources? Or is it something else entirely? Any
> are welcome.
> Also, I am currently running snort in the tcpdump file read mode, reading
> the files that our Shadow IDS created. Shadow only records the first 68
> bytes of each packet in the tcpdump log file. Is this enough packet data
> the Snort rules? Or will Snort work better with more or the entire packet?
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users