[Snort-users] Good Gbit card for Snorting?

Bob Walder bwalder at ...3902...
Wed Nov 14 03:45:05 EST 2001


Abe,

Hey... all suggestions welcome .... we might not take them all on board, of
course.... ;o)

Seriously, given the constraint that we don't want to turn this into a
massive comparison test between different gigabit cards or OS platforms
(perhaps that may come later, but not for now) then we would be happy to
hear any suggestions as to how we could optimise the reference platform(s).

At present, we are planning:

Intel Pentium III 1GHz
768MB SDRAM
Intel Pro/1000T Server adapter (Gigabit)
FreeBSD 4.4

Intel Pentium 4 1.8GHz
Intel 850 chipset
512MB RDRAM
Intel Pro/1000T Server adapter (Gigabit)
FreeBSD 4.4

Tested on both 100Mbit and Gigabit network
Same platform with Intel Pro/100 adapter on 100Mbit network
We may get to test on Red Hat 7.x too if time permits

As I said, the aim is to see just how much performance we can squeeze out of
Snort, so any previous experiences of optimising Snort, memory usage, the
adapter/driver combination or the underlying OS are welcome.

Regards,

Bob Walder


-----Original Message-----
From: Abe L. Getchell [mailto:abegetchell at ...530...]
Sent: 13 November 2001 20:46
To: Bob Walder
Cc: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] Good Gbit card for Snorting?


Hi Bob,
	BSD?  I mean, come on, it's not like it's the OS that Snort is
developed on or anything... Oh wait. =)  Are you going to allow the
community to provide input into the optimization process?  It seems that
one rant I always hear after an evaluation of a product is published, is
that the organization doing the testing didn't tweak <insert something
obscure here> to allow the box to burn through data a tad more quickly.
It would be really cool if you would take in some collective knowledge
from the community, as I'm sure some of the guys/gals here working in
the trenches have some interesting tricks up their sleeves...

Thanks,
Abe

--
Abe L. Getchell
Security Engineer
abegetchell at ...530...


> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of
> Bob Walder
> Sent: Tuesday, November 13, 2001 3:43 AM
> To: abegetchell at ...530...
> Cc: snort-users at lists.sourceforge.net
> Subject: RE: [Snort-users] Good Gbit card for Snorting?
>
>
> Abe,
>
> You get to see this twice since I forgot to cc the list the
> first time.... d'oh!
>
> No plans to do this at present, since we have pretty much
> settled on FreeBSD as our reference platform. The plan is to
> build a complete box, optimised as far as possible in every
> respect, as a sort of "proof of concept" to see how fast
> Snort can go on a platform made up of freely available components.
>
> Regards,
>
> Bob
>
>
> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of
> Abe L. Getchell
> Sent: 13 November 2001 01:25
> To: Bob Walder
> Cc: snort-users at lists.sourceforge.net
> Subject: RE: [Snort-users] Good Gbit card for Snorting?
>
>
> Hi Bob,
>
> Any plans to benchmark the Gbit sensor on the same hardware
> running different OS's?  It would be nice to see how the
> multiple x86 OS's Snort runs on would perform using the same
> hardware under the same conditions at Gbit speeds.
> Regardless, can't wait to see the results.  Please do post a
> note to the list when you're done as I'm sure many of us here
> are eager.
>
> Thanks,
> Abe
>
> --
> Abe L. Getchell
> Security Engineer
> abegetchell at ...530...
>
>
> > -----Original Message-----
> > From: Bob Walder [mailto:bwalder at ...3902...]
> > Sent: Monday, November 12, 2001 4:24 AM
> > To: abegetchell at ...530...; snort-users at lists.sourceforge.net
> > Subject: RE: [Snort-users] Good Gbit card for Snorting?
> >
> >
> > Abe,
> >
> > Might not fit into your time scales, but we are about to build a
> > reference platform using high-end Pentium, lots of RAM,
> Intel Gigabit
> > card, FreeBSD 4.4 and Snort - just to see what it can do.
> We probably
> > won't get around to testing it until December, however.
> Results will
> > be made public
> >
> > Regards,
> >
> > Bob Walder
> > Director
> >
> > The NSS Group
> > England
> >
> > Internet: http://www.nss.co.uk
> >
> >
> > -----Original Message-----
> > From: snort-users-admin at lists.sourceforge.net
> > [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Abe L.
> > Getchell
> > Sent: 11 November 2001 20:50
> > To: snort-users at lists.sourceforge.net
> > Subject: [Snort-users] Good Gbit card for Snorting?
> >
> >
> > Greetings!
> >
> > Has anyone run into a particular Gbit card which has worked
> well for
> > them under Linux for Snorting?  I've searched on Google, as well as
> > other resources, and can't really come up with anything
> except people
> > sharing their bad experiences doing so. =)  I tend to lean towards
> > Intel, as I've had good experiences in the past with their 10/100
> > cards, but I thought I'd check with ya'll to see what the collective
> > community opinion was.
> >
> > Thanks,
> > Abe
> >
> > --
> > Abe L. Getchell
> > Security Engineer
> > abegetchell at ...530...
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/s> nort-users
> >
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list