[Snort-users] 3 or 4 NICs in a sensor?

Ben Feinstein me at ...6289...
Fri Sep 27 16:10:02 EDT 2002


Beware of the bargain priced 4-port cards, you may get what you pay for.
For normal operation, they usually work fine, but promisc can be
troublesome.  Personally, I've had bad experiences with running Snort on
the D-Link DFE-570TX 4-port NICs.  They are awfully cheap ( < $200),
however.

On the other hand, I've had all good experiences with using Intel PRO/100
S 2-port NICs.  Not cheap, but rock solid.  If you have the funds, a
couple of those cards would do nicely.  They have good Linux support
through either Intel's e100 driver or Donald Becker's eepro driver.
Others may disagree with me, but I'd recommend using the e100 driver w/
this particular card.  I think kernel 2.4.19 is now including a version of
the Intel e100 driver.

Hope this helps,
Ben

On Fri, 27 Sep 2002, Erek Adams wrote:

> Short answer:  Yes, do it.
>
> Longer answer:  Works like a charm.  One other thing that you might want to
> consider is to use a quad port card.  One slot, but 4 ports.  I'm not sure on
> pricing, but the Sun QFE used to be around $1200.  I'm sure you can get one
> cheaper than that.  I'm sure if you check websites you can find a good deal on
> them...
>
> Cheers!
>
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net





More information about the Snort-users mailing list