Foundry performance? (was "Re: [Snort-users] Cisco Catalyst - SNORT")

twig les twigles at ...131...
Fri Jun 27 16:53:02 EDT 2003


Is anyone running Foundry switches with Snort/sniffers?  I
tested some Big Irons and Fast Irons about 3 years ago and they
seemed to be smoking fast but management killed the idea because
we had a great service contract with Cisco already.


--- Jeff Nathan <jeff at ...950...> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> 
> - --On Friday, June 27, 2003 7:34 -0400 Gary Flynn
> <flynngn at ...6811...> wrote:
> 
> >
> >
> >
> > I'm not saying the switch works this way but if the packets
> are on a bus
> > and configuring a span port just means telling the port to
> grab anything
> > on the bus, it would seem there would be no performance hit.
> 
> Grabbing those frames and sending them out a different
> interface still 
> requires I/O operations (interrupt request processing and the
> like). 
> Hidden as it may be, there's always a price.
> 
> EOF.
> 
> 
> > --
> > Gary Flynn
> > Security Engineer - Technical Services
> > James Madison University
> >
> > Please R.U.N.S.A.F.E.
> > http://www.jmu.edu/computing/runsafe
> 
> - -Jeff
> 
> - --
> http://cerberus.sourcefire.com/~jeff       (gpg key available)
> Great spirits have always encountered violent opposition from
> mediocre
> minds.
> - - Albert Einstein
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (Darwin)
> 
>
iD8DBQE+/NHeEqr8+Gkj0/0RAiAVAJ0TqCbb/4ZaTCrA3P6UOzXO14aBnQCfei+a
> Ez7l4RxzeObF2ipc/aQkllg=
> =OOuU
> -----END PGP SIGNATURE-----
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites
> including
> Data Reports, E-commerce, Portals, and Forums are available
> now.
> Download today and enter to win an XBOX or Visual Studio .NET.
>
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
-----------------------------------------------------------
Emo is what happens when the glee club goes punk.       
-----------------------------------------------------------

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com




More information about the Snort-users mailing list