[Snort-users] What does lightweight mean?

Talisker Talisker at ...423...
Thu May 31 13:22:01 EDT 2001


The term "lightweight" is referring to the minimal resources used by Snort,
whilst a common misconception the term does not reflect Snorts performance
as an IDS.

Take Care
Talisker's Network Security Tools List

Security Tools Notification
----- Original Message -----
From: "Anderson, Bill" <wander01 at ...2144...>
To: "'Snort Users'" <snort-users at lists.sourceforge.net>
Sent: Wednesday, May 30, 2001 3:19 PM
Subject: [Snort-users] What does lightweight mean?

> I have been considering Snort as an IDS for our organization, but several
> people have tried to steer me away because Snort is described as
> 'lightweight.' What does the term lightweight mean or imply? Does it mean
> can only handle light network traffic streams, or does it mean it is light
> in terms of needed resources? Or is it something else entirely? Any
> are welcome.
> Also, I am currently running snort in the tcpdump file read mode, reading
> the files that our Shadow IDS created. Shadow only records the first 68
> bytes of each packet in the tcpdump log file. Is this enough packet data
> the Snort rules? Or will Snort work better with more or the entire packet?
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list