[Snort-users] Snort Hardware Requirements

Mike Miller mike at ...16027...
Mon Apr 29 10:39:01 EDT 2013


I'm doing a similar analysis, but am coming to a different conclusion. 

First off, how much bandwidth are you looking at?

Second, do you REALLY NEED the entire ruleset?

Third, properly specifying the hardware produces good dividends. 

Fourth, what are you doing with the results, and how long are you looking to keep them?

I have a dl585G2 that's handling 800 mpbs with about a 7% drop rate. It's got 8 cores and 32 gb RAM. I suspect I could double that with a NIC that supports PF_ring in hardware, triple it if I made some concessions in the ruleset (I don't care if you're using MSN chat).

The replacement hardware will be a 8 slot shelf with a san, a dedicated blade for IDS, and another blade or two doing VMware'y things. I'm estimating two of these at a negotiated price around $40k a piece. They'll be sized to handle 10 gig per location, with some futureproofing in the chassis. 




On Apr 25, 2013, at 6:44 AM, "Soranno, Robert T." <Robert.Soranno at ...383...> wrote:

> Hi!
> 
> I'm trying to prepare a tradeoff analysis regarding hardware necessary to fully install Snort, its  per-processors and third party software.  I have been informed that the entire Snort install can require up to 4 blades.  Is there a document posted listing the memory and CPU requirements of all components so that I could pick/choose the per-processors, etc. to accommodate my needs and know how much real estate is necessary?
> 
> Thanks.
> ------------------------------------------------------------------------------
> Try New Relic Now & We'll Send You this Cool Shirt
> New Relic is the only SaaS-based application performance monitoring service 
> that delivers powerful full stack analytics. Optimize and monitor your
> browser, app, & servers with just a few lines of code. Try New Relic
> and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!





More information about the Snort-users mailing list