[Snort-users] Snort and high performance networks

Christopher Rapier rapier at ...11836...
Thu May 20 08:14:01 EDT 2004


We have a number of networks coming into out facility that I'm 
interested in monitoring with snort. The problem is that these networks 
are big. Really big. One of them is 30GBits (3 lambdas over dwdm). The 
smaller ones are OC48, 802.11ad bonded GigE, and so forth. My question 
is how much (in whatever terms you wish to use) can snort be reasonably 
expected to handle?

If anyone can point me to resources related to snort/bro/whatever in 
high performance networks I'd sure appreciate it.

Chris





More information about the Snort-users mailing list