Re: 3 or 4 NICs in a sensor?

[Ben Feinstein <me () benfeinstein net>]

Beware of the bargain priced 4-port cards, you may get what you pay for.
For normal operation, they usually work fine, but promisc can be
troublesome.  Personally, I've had bad experiences with running Snort on
the D-Link DFE-570TX 4-port NICs.  They are awfully cheap ( < $200),
however.

On the other hand, I've had all good experiences with using Intel PRO/100
S 2-port NICs.  Not cheap, but rock solid.  If you have the funds, a
couple of those cards would do nicely.  They have good Linux support
through either Intel's e100 driver or Donald Becker's eepro driver.
Others may disagree with me, but I'd recommend using the e100 driver w/
this particular card.  I think kernel 2.4.19 is now including a version of
the Intel e100 driver.

Hope this helps,
Ben

On Fri, 27 Sep 2002, Erek Adams wrote:

> Short answer:  Yes, do it.
>
> Longer answer:  Works like a charm.  One other thing that you might want to
> consider is to use a quad port card.  One slot, but 4 ports.  I'm not sure on
> pricing, but the Sun QFE used to be around $1200.  I'm sure you can get one
> cheaper than that.  I'm sure if you check websites you can find a good deal on
> them...
>
> Cheers!
>
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users