[Snort-users] Snort and L2 Cache

Dirk Geschke Dirk at ...10648...
Thu Dec 4 14:44:02 EST 2003

Hi Irwan,

> I'm curious, for a new Snort box which one will be better?
> Use dual processor, P IV Xeon with for example 2.8 Ghz and 512 KB L2
> Cache, or single processor P IV Xeon with 3.06 Ghz but with 1 MB L2
> Cache?
> Does the size of L2 cache of the processor matters in speeding up Snort,
> especially in monitoring gigabit Ethernet traffic?

I think the more important question is: What should run on
this machine? If it is only for running snort then you won't
have much advantage of a second processor if are only running
one instance of snort. (Snort does not use threads and is
therefore bound to one processor.)

If you have additionally a database running on the same 
machine then I think it would be better to have two processors.

But this is not a question of the L2 Cache...

Best regards

Dirk Geschke

More information about the Snort-users mailing list