[Snort-users] Linux of FreeBSD

Olav Langeland Olav.Langeland at ...2038...
Tue Nov 27 01:49:01 EST 2001

From: Erek Adams [mailto:erek at ...577...]
Sent: 26. november 2001 17:16

>On Mon, 26 Nov 2001, Olav Langeland wrote:
>> I am seeking advice on what is best suited for Snort use, Linux or
>> FreeBSD. It will monitor either a dual E3 link (currently at 50%
>> capacity) or a single port producing about 30-40Mbit. Will Debian
>> handle this kind of traffic without problem, or is FreeBSD a better
>> choice? The machine in question is P3-800, 512MB Ram and SCSI raid.

>Well, you're about to get into a Holy OS War, but other than that...
>don't let friends use RedHat.  :-)

>Keep this fact in mind:  Run snort on _your_ OS first.  If it fails, or
>packets, YOU (as an admin) will see and notice that.  On stuff you
know, it's
>easier to understand and fix.  Then if you can't fix it, try another
>That's the long and short of it from the trenches.

Religion wars have been started for less, I know :) I was more
interested in TCP/IP performance issues than "what is the best OS" kind
of arguments, but these days it seems there isnt a huge difference after
the 2.4.x kernel.

Thanks for all the help.

Olav Langeland <> olav.langeland at ...2038...

More information about the Snort-users mailing list