I am running the following hardware:
3.0 Ghz P4 socket 478 CPU
200 GB SATA HDD
2 GB PC 2700 RAM
Board specs are here:
http://www.supermicro.com/products/motherboard/P4/E7210/P4SCE.cfm
I tried sending the Alerts to a unified alert file. I took a class on
Building and Operating Snort back in March ( Thanks again Alex!!!) and
learned that the Binary output was the fastest way for Snort to process the
information since it does not have to covert it from binary to clear text
for me to read. If this would have worked I would have found a way to
convert it back to Syslog for my needs. Unfortunately I am dropping about
the same amount of packets no matter how I output the Alerts.
Here is the interface stats. I am taking a ton of info in each second.
GigabitEthernet0/24 is up, line protocol is down (monitoring)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 213264000 bits/sec, 28623 packets/sec
I really am starting to think that I may need more than one sensor for this
segment of traffic. I am going to lower the number of ports I am monitoring
to 1 and see how that works, then go to two, and etc... until I find the
right balance for this one sensor. Currently I have 4 sensors built up for
different segments of my network. I can put all of these on this part if I
have too for testing.
On 10/26/05, Richard Bejtlich <taosecurity@gmail.com> wrote:
Joseph Nicholson wrote:
This is my core switch and brings about 5 different network segments
together...
The monitor port is a Gigabit port and the monitoring ethernet port is
running
at a Gigabit also.
Hi Joseph,
Do you have an idea of how much bandwidth you are watching on this SPAN
port?
Can you share some specifications for your hardware -- RAM, PCI bus, etc.?
Have you tried just sending alerts to an alert file, for testing?
Thank you,
Richard
http://www.taosecurity.com
--
Joseph Nicholson
