[Snort-users] High-Performance Installation Reccomendations for Snort?

Jon Ottar Runde jorunde at ...5394...
Fri Mar 29 03:18:04 EST 2002


On to , 2002-03-28 at 19:26, Ryan Hill wrote:
> All,
> 
> After spending quite some time with an extremely stable RH 7.2, snort,
> mysql, apache and demarc combination with two sensors, I've decided that I'd
> like to expand my sensor network to between 4 and 6 sensors (migrating to a
> new machine) running on a low to moderately busy 10/100 switched network.  
> 
> Because of this, I fear that Linux may not be able to keep up with the
> overhead and stay running smoothly, so I'm soliciting opinions from the list
> (in public or private) on your reccomendations for an optimum server
> configuration.
> 
> Planned Hardware Specs
> PIII 933
> 384 MB RAM
> 40 GB ATA 100 IDE
> 1 Intel NIC (on-board)
> 2 Quad Ethernet Port PCI Cards

Why do you think that linux may not be able to keep up?

I would try it first, if I were you. RH 7.2 w/updates (kernel 2.4.9-31)
is extremely stable here, -running snort and ntop on 4-5 100/switched
interfaces. I do have 2 CPUs and SCSI, and that might help with
performance....


Jon O





More information about the Snort-users mailing list