[Snort-users] Gigabit usage question

Martin Roesch roesch at ...1935...
Mon Oct 15 07:12:06 EDT 2001


It should be noted that the IP stack of any operating system is not used
by Snort at all, we do our own decoding and don't require that there be
an IP stack at all...

     -Marty

Saad Kadhi wrote:
> 
> On Thu, 2001-10-11 at 00:44, Phil Wood wrote:
> >
> > On Wed, Oct 10, 2001 at 04:35:40PM -0400, Al.Wever at ...3765... wrote:
> > > Hello everyone,
> > > If this has been asked before I apologize for the duplication.
> > >
> > > My question is, has anyone used Snort v1.8.1 or the WIN32 version on a
> > > Gigabit network?
> >
> > Yes [linux v1.8.1], but don't really see much more than 75Mbits.
> > Start to get a little loss there.  So, I'm not the one to be talking.
> > Who out there actually sees 500Mbit and above? (Except when running a
> > SmartBits box and looking at when a particular stateful firewall falls over.)
> 
> Matt Dillon (not the actor, the FreeBSD core team member) has recently
> stated that they have done lotta work on the IP stack of the current
> development branch & now FreeBSD can handle up to 900Mb/s on GigE. This
> is near-theoritical limits for GigE.  so if you are really worried about
> performance problems & you expect a *lot* of traffic, then you might try
> going with -current FreeBSD.
> 
> --
> /saad
> [put your signature here]
> self-customize-sig(tm). another dumb patent...
> nodisclaimer
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org




More information about the Snort-users mailing list