Snort mailing list archives
Re: High Speed Network Cards + rules?
From: Christopher Rapier <rapier () psc edu>
Date: Mon, 24 May 2004 15:32:49 -0400
On May 24, 2004, at 3:08 PM, Keith W. McCammon wrote:
It is my understanding that most network cards at 50% capacity begin to miss packets and create a false negatives condition (IDS evasion technique). Is anyone aware of any cards that exist that collect 100% of the traffic with 0% false negatives due to this condition? If not, what is the nextbest thing?The amount of dropped packets is a function of a lot more than the card. You have memory, CPU, etc. Having a good card (Intel Pro has always worked very well for me--as good as any) goes a long way, but you need a goodly amount of RAM and CPU time to keep up if
What do you mean by high speed? If you mean GigE then I'd move to a fiber card with a 64bit bus. We use the Syskonnect SK-9843 here and its really top notch. I don't know much about copper GigE cards as we just don't use them here.
If you mean 100bT then the Intel Pro cards are good. We use them a lot as well.
------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10gGet certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Snort and high performance networks, (continued)
- Re: Snort and high performance networks Jason Haar (May 23)
- RE: Snort and high performance networks snort user (May 21)
- Re: Snort and high performance networks Christopher Rapier (May 21)
- RE: Snort and high performance networks Rafael Ortega (May 21)
- Re: Snort and high performance networks snort user (May 21)
- RE: Snort and high performance networks SN ORT (May 21)
- RE: Snort and high performance networks Kreimendahl, Chad J (May 21)
- Re: Snort and high performance networks Aaron (May 24)
- High Speed Network Cards + rules? Adriel T. Desautels (May 24)
- Re: High Speed Network Cards + rules? Keith W. McCammon (May 24)
- Re: High Speed Network Cards + rules? Christopher Rapier (May 24)
- Re: High Speed Network Cards + rules? Matt Kettler (May 24)
- Re: High Speed Network Cards + rules? James Riden (May 24)
- Re: High Speed Network Cards + rules? James Riden (May 25)
- High Speed Network Cards + rules? Adriel T. Desautels (May 24)
- Re: High Speed Network Cards + rules? Tod Beardsley (May 24)
- Re: Re: Snort and high performance networks Aaron (May 25)
- Re: Re: Snort and high performance networks Micha Silver (May 26)
- Re: Snort and high performance networks Chris Rapier (May 20)