[Snort-users] gigabit nic?

Erek Adams erek at ...577...
Tue Sep 10 12:31:05 EDT 2002

On Tue, 10 Sep 2002, Sheahan, Paul (PCLN-NW) wrote:

> I'm running Snort 1.8.7 on RH Linux 7 on a Compaq DL360. I'm wondering if I
> can install a gigabit NIC in the box? How high of throughput can Linux/Snort
> handle and would this change benefit me at all? We currently don't have
> heavy traffic, but I'm wondering if a large attack were to come along, would
> Snort still be able to catch attacks at higher NIC speeds?

Snort doesn't care about the NIC too much.  As long as snort can talk to
libpcap and get info, it wouldn't care if it was a tincan and string on the
other side.  :)

Now, if your OS can handle the GBIC, that's another question.  You'll need
good drivers and a solid card.  Check out Intel--Someone told me of a eval
demo deal to get a 10/100/1000 (Gig over copper) card for about $33.  Check
out the offers on the website, you might find one for testing.

The more hardware you can throw at snort the happier it becomes.  Just like
any other pig, the more mud, the better.  :)

Erek Adams

More information about the Snort-users mailing list