[Snort-users] Snort, VM or physical server ?

Ryan Martin rmartin at ...15986...
Thu Jun 16 12:55:06 EDT 2016

I think in the end it isn’t so much which is better, but which meets your requirements and is most cost effective.  If you already have a hypervisor, VM’s are (relatively speaking) cheap.  Spin up a VM and see if it can handle the load you throw at it.  If so, then done in one.  If not, then increase VM guest resources.  If that’s not possible, then do some more homework given your specific implementation requirements and check out purchasing some hardware to back it up.

My personal preference is hardware, and a dedicated box.  I like having it separate, but I really could argue that one either way.



On Jun 16, 2016, at 11:49, Nicolas Lepolard <Nicolas.Lepolard at ...17447...<mailto:Nicolas.Lepolard at ...17447...>> wrote:


I have a simple question :

Is it better to install Snort on a virtual machine or on a physical server? And why ?

Thank you !

Nicolas Lepolard

What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports. http://pubads.g.doubleclick.net/gampad/clk?id=1444514421&iu=/41014381_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20160616/1097aa56/attachment.html>

More information about the Snort-users mailing list