[Snort-users] Snort and high performance networks

Kreimendahl, Chad J Chad.Kreimendahl at ...4716...
Fri May 21 12:10:05 EDT 2004

Our 3-4Gbps system is one system with built in quad-gigE interfaces.  We
have no 10Gbps interfaces deployed (yet), as we have no need for them
(and no network pushing that kind of data yet).  The vast majority of
the time, the system is handling less than 1Gbps.  However, there are
periods of time, on a daily basis, when the threshold is neared.   

For the most part, the way we first verified these systems would handle
3-4G each was to use tcpreplay in a manner that's being discussed now by
Gary Portnoy.  Check out his most recent post.  As far as handling
30Gbps, I'm fairly certain even if it was quad-10GigE, we could NOT
handle it.  It appears from the performance of these systems that they
could probably handle closer to 5-6 Gbps... But that's just my theory. 

-----Original Message-----
From: SN ORT [mailto:snort_on_acid at ...131...] 
Sent: Friday, May 21, 2004 1:14 PM
To: snort-users at lists.sourceforge.net
Cc: rafael.ortega at ...11845...; rapier at ...11836...; Kreimendahl, Chad J
Subject: RE: [Snort-users] Snort and high performance networks

Are you guys ACTUALLY running traffic at 800Mbps or
even 2-3 Gbps? I mean what application or server
process that much data on the line? This dood stated
he had an OC-whatever pumping 30Gbps, and Chad asked a
very appropriate question as to how on earth anyone
would Snort that line short of buying a machine with
an OC-3 $$ (CHA-CHING!) interface stuck in it. Most
people would use Sniffer with a WAN interface and
network fiber taps to get "quick snapshots". 

Back to the 3-4Gbps line, you have 10Gbps interfaces
deployed already? How exactly are you seeing 3-4Gbps
traffic, and is it steady and what applications use
that? I mean most switches see that kind of total 
backbone traffic and you can actually use switch-based
IDS (like the one from Cisco)...unless of course you
have a 10Gbps backbone, but to where does that much
traffic travel? 



More information about the Snort-users mailing list