[Snort-users] Snort as a gigabit sensor ... on a Sun box

Edin Dizdarevic edin.dizdarevic at ...7509...
Wed Jul 30 02:08:09 EDT 2003

Well, seems nobody is reading the FAQ anymore...

Why are we discussing about such things knowing nothing about
boundary conditions?

Will "somuch hard- & software" handle "somuch traffic"?

Are the things so simple?

"Yes, if you're looking for ARP packets", would be the right
answer for that kind of question AFAIC.

And: "No if Snort is logging in a DB by itself...".

In my eyes people asking such questions are absolute novices
in networking - not only in network based intrusion detection.

Is this assumption correct?

If yes:

Guys, please read the FAQ and older threads about packet
dropping problems. The answers are already there, because
we've all been absolute beginners at some point and had the
same questions you ask now.



twig les wrote:
> Hey all, since the crowd is chatting about gigabit sensors, can
> anyone tell me if they are using a Sun box to get anything over
> 150Mbps, maybe up to 300?  I don't know much about Sun hardware
> and would prefer to avoid dropping $20,000 x 2.  This box will
> have to run (sigh) Solaris 8.

Edin Dizdarevic

More information about the Snort-users mailing list