[Snort-users] Linux of FreeBSD

Olav Langeland Olav.Langeland at ...2038...
Tue Nov 27 01:49:01 EST 2001


From: Erek Adams [mailto:erek at ...577...]
Sent: 26. november 2001 17:16

>On Mon, 26 Nov 2001, Olav Langeland wrote:
>> I am seeking advice on what is best suited for Snort use, Linux or
>> FreeBSD. It will monitor either a dual E3 link (currently at 50%
>> capacity) or a single port producing about 30-40Mbit. Will Debian
Linux
>> handle this kind of traffic without problem, or is FreeBSD a better
>> choice? The machine in question is P3-800, 512MB Ram and SCSI raid.

>Well, you're about to get into a Holy OS War, but other than that...
Friends
>don't let friends use RedHat.  :-)

>Keep this fact in mind:  Run snort on _your_ OS first.  If it fails, or
drops
>packets, YOU (as an admin) will see and notice that.  On stuff you
know, it's
>easier to understand and fix.  Then if you can't fix it, try another
OS.
>That's the long and short of it from the trenches.

Religion wars have been started for less, I know :) I was more
interested in TCP/IP performance issues than "what is the best OS" kind
of arguments, but these days it seems there isnt a huge difference after
the 2.4.x kernel.

Thanks for all the help.

-- 
Olav Langeland <> olav.langeland at ...2038...




More information about the Snort-users mailing list