[Snort-users] Linux of FreeBSD

Martin Roesch roesch at ...1935...
Tue Nov 27 05:57:08 EST 2001

You should keep in mind that the IP stack performance is completely
irrelevant for an application like Snort, we don't use the IP stack at


Olav Langeland wrote:
> From: Erek Adams [mailto:erek at ...577...]
> Sent: 26. november 2001 17:16
> >On Mon, 26 Nov 2001, Olav Langeland wrote:
> >> I am seeking advice on what is best suited for Snort use, Linux or
> >> FreeBSD. It will monitor either a dual E3 link (currently at 50%
> >> capacity) or a single port producing about 30-40Mbit. Will Debian
> Linux
> >> handle this kind of traffic without problem, or is FreeBSD a better
> >> choice? The machine in question is P3-800, 512MB Ram and SCSI raid.
> >Well, you're about to get into a Holy OS War, but other than that...
> Friends
> >don't let friends use RedHat.  :-)
> >Keep this fact in mind:  Run snort on _your_ OS first.  If it fails, or
> drops
> >packets, YOU (as an admin) will see and notice that.  On stuff you
> know, it's
> >easier to understand and fix.  Then if you can't fix it, try another
> OS.
> >That's the long and short of it from the trenches.
> Religion wars have been started for less, I know :) I was more
> interested in TCP/IP performance issues than "what is the best OS" kind
> of arguments, but these days it seems there isnt a huge difference after
> the 2.4.x kernel.
> Thanks for all the help.
> --
> Olav Langeland <> olav.langeland at ...2038...
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list

Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org

More information about the Snort-users mailing list