Sometimes individual rules that are poorly written can crush your
sensors. Check out www.turbosnort.org for performance benchmarking of
your rule set, and toss or rewrite the rules that aren't efficient.
-----Original Message-----
From: mamo [mailto:mamo74@gmail.com]
Sent: Sunday, May 29, 2005 4:38 AM
To: Byron L. Sonne
Cc: Randall Jarrell; focus-ids@securityfocus.com
Subject: Snort on Gigabit [was Re: IDS\IPS that can handle one Gig]
Hello Everybody.
On 5/21/05, Byron L. Sonne <blsonne@rogers.com> wrote:
It's not a vendor, but I've heard people have been running Snort quite
well on gig links.
In this days I am trying to configure Snort to analyze traffic on a busy
gigabit link (400-600Mbit), and I am finding I lose 60-80% traffic with
the default snort config on freebsd (with device polling and some kernel
tuning for sniffing purpose) with a quite good hardware. From my first
analysis it looks like the problem is in how the prepocessor works and
are configured (without preprocessor I can process near all the traffic)
Is there anybody that used snort on gigabit connection that can share
with us experience and tuning tips?
Best Regards,
Mamo
PS
For sourcefire people or people that used their product.. What are the
difference between the snort engine in the sourcefire appliance and the
open source one?
------------------------------------------------------------------------
--
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
