On Mon, Dec 19, 2005 at 12:29:40PM +0000, aravind babu wrote:
Hi all,
I am planning to run Snort/Snort-Inline on the
following Hardware configuration.
Processor : 177MHz
RAM : 64MB
NAND FLASH : 128MB (Where Snort code will
exist.Also signatures)
Okay.
What processor? Is it a i386 based procesosr, or some wierd arm
embedded thing, or the
MIPS thing you were working on in Dec 2003?
Is it worth to do this?I am planning to build a
appliance which will have functionalities of
Firewall,VPN,and IDS/IPS.
But the question is why? and where are you going to put it?
It could be a wonderfull solution, or a very bad solution depending on
the problems that are
being addressed.
Please tell me your views on this.
Snort without rules, is about 8 Megabytes in core (on the machine
sitting before me), with the default
ruleset it's up to 40 Megabytes, and with the VRT_PR rules, community rules and
Bleeding edge snort rules, you're
up to maybe 60 Megabytes.
So you'r going to have to config the ruleset way way down, same thing
for the preprocessors.
Other interesting questions. Where are the alerts going to go? Back
down the vpn connection?
You'll be able to do it, just make sure that your expectations are set
correctly. 177MHz is _reallly_ slow, and 64 MB is _really_ small. If you are
looking to IDS/IPS over a modem vpn connection, it'll probibly be fast enough.
If you are looking to IDS/IPS over a 10/100 ethernet port(s)... The answer is
probibly not as much.
That being said. It could be a nifty little device, to send along with
peoples laptops
as a network condom.
-gulfie
Thanks in advance,
Aravind.
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
