[Snort-users] Linux of FreeBSD
roesch at ...1935...
Tue Nov 27 05:57:08 EST 2001
You should keep in mind that the IP stack performance is completely
irrelevant for an application like Snort, we don't use the IP stack at
Olav Langeland wrote:
> From: Erek Adams [mailto:erek at ...577...]
> Sent: 26. november 2001 17:16
> >On Mon, 26 Nov 2001, Olav Langeland wrote:
> >> I am seeking advice on what is best suited for Snort use, Linux or
> >> FreeBSD. It will monitor either a dual E3 link (currently at 50%
> >> capacity) or a single port producing about 30-40Mbit. Will Debian
> >> handle this kind of traffic without problem, or is FreeBSD a better
> >> choice? The machine in question is P3-800, 512MB Ram and SCSI raid.
> >Well, you're about to get into a Holy OS War, but other than that...
> >don't let friends use RedHat. :-)
> >Keep this fact in mind: Run snort on _your_ OS first. If it fails, or
> >packets, YOU (as an admin) will see and notice that. On stuff you
> know, it's
> >easier to understand and fix. Then if you can't fix it, try another
> >That's the long and short of it from the trenches.
> Religion wars have been started for less, I know :) I was more
> interested in TCP/IP performance issues than "what is the best OS" kind
> of arguments, but these days it seems there isnt a huge difference after
> the 2.4.x kernel.
> Thanks for all the help.
> Olav Langeland <> olav.langeland at ...2038...
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org
More information about the Snort-users