[Snort-users] Help me choose which system to run snort on.

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Tue Nov 30 01:29:16 EST 2004

--On 30 November 2004 00:58 -0600 "Harper, Patrick" 
<patrick.harper at ...11593...> wrote:

> Snort is not multi processor aware, I would go with he faster box.
> -----Original Message-----
> From: Basselgia, Barry A Mr (NAF Atsugi)
> [mailto:BABasselgia at ...12104...]
> Sent: Tuesday, November 30, 2004 12:06 AM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Help me choose which system to run snort on.
> I'm building an IDS network, I'll end up with about 6 snort sensors
> feeding
> back to a snort server.
> The snort server will be running:
> Linux
> mysql
> apache
> snort
> barnyard
> acid/base
> open aanval
> There are 2 servers available and I've been given my choice.  Basically,
> the
> servers are the same with regard to memory and hard drives.  The
> difference
> is that one is a dual processor system with 2 x 1 GHz processors and the
> other is a single processor system with a 2 GHz processor.
> I'm kind of leaning towards the dual processor system, but I wanted to
> see
> if anyone had any suggestions before I made up my mind.

Why are you planning on running Snort on the backend database server, given 
that you have 6 sensors already?

Assuming that this is unnecessary, I'd agree with the OP's assessment than 
the dual processor machine would be best; hopefully Apache and the PHP apps 
will end up running on one processor, and MySQL and barnyard on the other.

> Thanks,
> Barry

Best Regards,
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9

More information about the Snort-users mailing list