[Snort-users] Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message)
secureplay at ...9090...
Wed Dec 10 22:32:02 EST 2003
We are monitoring a gigabit line using a Proliant DL-380G2 server (1.4 GHz
processor and E1000 SX-fiber NICs (forget which model, but Intel branded))
Have not seen any dropped packets even during peak times (which admitedly,
do not max out our gigabit line, they may spike to 30%-40% on rare
occasions, but is usually around 10%). The server has 1GB of ram, and is
logging to a SQL Server 2000. Running on FreeBSD 4.8. The average load (not
during peak times) is about 0.75 - 1.25. Single processor configuration.
We have trimmed out some of the rules. For example, since the network we are
protecting is a Windows network, we have removed anything that may not apply
to windows... We don't monitor for porn, etc. we are more interested in
virus outbreaks. Also not particularly interested in portscans, so we have
removed that detection as well.
More information about the Snort-users