Snort mailing list archives
RE: Snort and high performance networks
From: "Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>
Date: Thu, 20 May 2004 10:45:17 -0500
Well, I'm sure there is a system out there that can handle this, but my question would be: How in the world do you expect to get a 30GBps connection pumped to unix/win machine? Assuming Cisco device, you might be able to pump 2 SPANS (at 1G each) to a sensor... The other two should be no problem... But that 30G on a single device... Rough one. -----Original Message----- From: Christopher Rapier [mailto:rapier () psc edu] Sent: Thursday, May 20, 2004 10:13 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Snort and high performance networks We have a number of networks coming into out facility that I'm interested in monitoring with snort. The problem is that these networks are big. Really big. One of them is 30GBits (3 lambdas over dwdm). The smaller ones are OC48, 802.11ad bonded GigE, and so forth. My question is how much (in whatever terms you wish to use) can snort be reasonably expected to handle? If anyone can point me to resources related to snort/bro/whatever in high performance networks I'd sure appreciate it. Chris ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id149&alloc_id66&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort and high performance networks Christopher Rapier (May 20)
- R: Snort and high performance networks Fausto Marzi (May 20)
- Re: Snort and high performance networks Jeff Coppock (May 21)
- <Possible follow-ups>
- RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
- Re: Snort and high performance networks Christopher Rapier (May 20)
- RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
- Re: Snort and high performance networks Chris Rapier (May 20)
- RE: Snort and high performance networks Rafael Ortega (Jun 01)
- RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
- RE: Snort and high performance networks Rafael Ortega (May 21)
- Re: Snort and high performance networks Jason Haar (May 23)
- RE: Snort and high performance networks snort user (May 21)
- Re: Snort and high performance networks Christopher Rapier (May 21)
- RE: Snort and high performance networks Rafael Ortega (May 21)
(Thread continues...)