[Snort-users] Snort Sensor Hardware

Jason Alexander lists at ...9901...
Wed Dec 10 14:32:04 EST 2003


Matt Kettler wrote:

 > At 03:59 PM 12/10/2003, SRH-Lists wrote:
 >
 >> For 1U rackmount boxes pre-installed with linux (several flavor options)
 >> or {Net,Free,Open}BSD, check out
 >> http://www.ironsystems.com
 >>
 >> Much cheaper than the Dell 1U's.
 >
 >
 >
 > They are?
 >
 > The closest match I could configure is:
 >
 > dell poweredge 650 2.4g p4, floppy, cdrom, 40g ide, 256m, redhat, 
dual gig-e
 > $1168
 >
 > Iron systems A220 2.4g p4,  no floppy, cdrom, 40g ide,256m, redhat, 
dual 100mbit (no gig-e)
 > $1,008.80 (one gig-e available for +$127)
 >
 > The A160 can be made to have 2 gig-e's but that's more expensive, but 
you wind up with more hardware - 4 ethernet interfaces: 2 10/100, 2 
10/100/1000.
 > That one comes in at $1,210.40 for the same basic config, but with 2 
onboard 10/100's 1 onboard gig-e, and 1 pci-slot gig-e.
 >
 > Really I'd see Iron systems as having the advantage in different OS 
configs, ie: offering BSD's and linux, but the price difference is 
pretty negligible for same-class hardware. (they do offer much lower end 
hardware though)
 >


Just looking at the configs I'm not sure.  One thing that I was looking 
for was 64bit PCI. I would think in a snort sensor that would be one of 
the things that you would want to have the most.  Since we don't plan on
storing any of the data on the sensors I don't much care about disk 
speed or size.  I only need one Gig-E interface for sure and can 
probably get away with a 10/100 for the connection to the database.


I guess the better questions is that since there are hundreds of 1U 
vendors out there what typically hardware are people using.  Like
I mentioned before I will be using Gig-E interface but really only
looking at most 40Mbit/s of traffic.

Jason






More information about the Snort-users mailing list