[Snort-users] Snort and high performance networks

Jeff Coppock jcoppock1 at ...5068...
Fri May 21 10:11:03 EDT 2004

On Thu, 20 May 2004 11:13:05 -0400
Christopher Rapier <rapier at ...11836...> wrote:

> We have a number of networks coming into out facility that I'm 
> interested in monitoring with snort. The problem is that these
> networks are big. Really big. One of them is 30GBits (3 lambdas over
> dwdm). The smaller ones are OC48, 802.11ad bonded GigE, and so forth.
> My question is how much (in whatever terms you wish to use) can snort
> be reasonably expected to handle?
> If anyone can point me to resources related to snort/bro/whatever in 
> high performance networks I'd sure appreciate it.
> Chris

I've seen it recommended on this list that for high-speed needs, the
Sourcefire appliance, which is based on the Snort code, is best.  If you
really want to build your own system, you'll need to build it not only
for high-speed networking (Gigabit NIC) but high-speed bus/cpu/disks as
well.  I can't make any recommendations there, sorry.

As for handling the likes of a 30Gbps link, I think server
load-balancing is your best bet.  However, you'll still need to funnel
the link down to around 500Mbps-1Gbps per IDS server.  Perhaps your
DWDM switch can mirror the 30Gb link into three 10GE links (per lambda?)
which can connect to a big Ethernet switch with three 10GE ports, which
then can mirror to 30 GigE ports.  Then you could use something like a
Nortel Alteon 2000 series load-balancing switch to take a few of these
GigE connections and load-balance to a big enough farm for all the

You have an interesting challenge ahead of you.  Good luck.


Jeff Coppock		Systems Engineer
Diggin' Debian		Admin and User

More information about the Snort-users mailing list