On Mon, Nov 21, 2005 at 09:14:41AM -0500, Rich Moffitt wrote:
I'm not an everyday snort user lately, but I think there are a couple of
questions we need to ask:
1) What kinds of rules do you plan on using on this traffic? (It'll
affect your processing needs)
2) You're on a 100Mbit switch, yet each interface will see 17 and 14GB
of traffic, respectively? I'm confused. What's the peak data rate
going through each interface? (Obviously not above 100Mbit)
3) What kind of logging do you intend on doing? Are you concerned about
having enough storage for this sensor?
More questions:
4) What OS are you planning on running?
Some Recomendations:
a) Get some nice gigabit Nics. Intel E1000s come to mind. Sure
you may not need gigabit, but the gigabit cards deal with traffic much
better than there slower breathren. Even the 32 bit version will be a
good start.
-gulfie
Regards,
Rich
Brian J. Dyrehauge wrote:
Hey Snort Users!
I'm about to buy some hardware, and need to know what specs to go with.
I'll be using Snort and MySQL on the same machine. We'll be monitoring
on 2 NICs. Net traffic will be, as far as I've been informed by our
customer, 17 GB on one NIC and 14 GB on the other NIC. The switch is a
100 MB, which means no Gigabit traffic.
Do you guys have any recommendations as to what hardware I should buy?
Take into consideration that it has to be non-expensive. ;)
Yours sincerely,
Brian
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
