[Snort-users] Linux of FreeBSD
Olav.Langeland at ...2038...
Tue Nov 27 01:49:01 EST 2001
From: Erek Adams [mailto:erek at ...577...]
Sent: 26. november 2001 17:16
>On Mon, 26 Nov 2001, Olav Langeland wrote:
>> I am seeking advice on what is best suited for Snort use, Linux or
>> FreeBSD. It will monitor either a dual E3 link (currently at 50%
>> capacity) or a single port producing about 30-40Mbit. Will Debian
>> handle this kind of traffic without problem, or is FreeBSD a better
>> choice? The machine in question is P3-800, 512MB Ram and SCSI raid.
>Well, you're about to get into a Holy OS War, but other than that...
>don't let friends use RedHat. :-)
>Keep this fact in mind: Run snort on _your_ OS first. If it fails, or
>packets, YOU (as an admin) will see and notice that. On stuff you
>easier to understand and fix. Then if you can't fix it, try another
>That's the long and short of it from the trenches.
Religion wars have been started for less, I know :) I was more
interested in TCP/IP performance issues than "what is the best OS" kind
of arguments, but these days it seems there isnt a huge difference after
the 2.4.x kernel.
Thanks for all the help.
Olav Langeland <> olav.langeland at ...2038...
More information about the Snort-users