[Snort-users] Snort Install

Joel Esler jesler at ...1935...
Tue Dec 1 23:11:49 EST 2009

Of course the answer is "it depends".  Depends on what rules you are
running, packet structure, inline or not inline..  but let me give you a
reference of my machine.

It's a dual (not that it matters with Snort, but I thought it'd say it for
completeness sake) 1.4 Ghz processor machine with 2 gigs of ram and a 70G
harddrive.  This is a server class machine (read: 1U), but that shouldn't
matter much...

I can push over 100 Mb/s through this machine and not drop a single

Of course, my ruleset is finely tuned, as is my snort.conf.


On Tue, Dec 1, 2009 at 10:03 PM, Biggs Darklighter <
jedi_darklighter at ...125...> wrote:

> I'm sure this is a very open-ended question so ill try to be as specific
> as i can. i have searched the documents (ie User Manual, FAQ and install
> guides) as well as Google searched and message board searched and all i
> can find on install requirements is that " it depends". i am a home user
> and would like to have a system that runs like its supposed to. I am not
> opposed to building the machine its intended to run on, in fact that is
> what i intend to do. I have a single 1.5 meg DSL connection hopefully
> upgrading to cable in the future so depending on what ever package they
> offer could go up to 20 megs. I know connection speeds have little to do
> with hardware as a general whole. I am thinking of using at a minimum
> 2.0 Ghz AMD opteron processor with about 2 GB RAM and 74 GB Raptor HD. I
> hope to have the SQL database on another computer so as to take most of
> the load off my sensor.  I don't intend to have more then 10 users ever
> on this network and am wondering if this would be a good machine to use?
> any suggestions would be very helpful. I have never used and have not
> installed snort as of yet due to lack of working computers (4) lying
> around my house at the moment. Sorry if this seems like a stupid
> question but I cant seem to find a straight forward answer as to what a
> minimal install would use.
> --
> Sincerely,
>           Chris
> KeyID: 0x348DC808
> Keyserver: pool.sks-keyservers.net
> ------------------------------------------------------------------------------
> Join us December 9, 2009 for the Red Hat Virtual Experience,
> a free event focused on virtualization and cloud computing.
> Attend in-depth sessions from your desk. Your couch. Anywhere.
> http://p.sf.net/sfu/redhat-sfdev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Joel Esler | 302-223-5974 | gtalk: jesler at ...1935...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20091201/1de66d34/attachment.html>

More information about the Snort-users mailing list