Snort mailing list archives
Re: Advice on quad ethernet card
From: sekure <sekure () gmail com>
Date: Mon, 29 Nov 2004 13:43:01 -0500
YMMV, but I am using the PCI-X Quad GigE card from Intel, on HP DL360 and Linux Enterprise Server. All 4 card interfaces are set to promisc. and I am using the on-board NIC as the management interface. Not really seeing any issues described by others, though I am not coming even close to 100Mbps, more like 10 on each interface. On Mon, 29 Nov 2004 12:33:04 -0600 (CST), Glenn Forbes Fleming Larratt <glratt () rice edu> wrote:
I have done this. I'd advise against that particular configuration, as I've experienced bus contention, memory leaking, and general suckage requiring weekly prophylactic reboots, when trying to run even 2 of the four interfaces on a quad both in promiscuous mode. Scaling down to one i/f on the quad and deploying a separate card for the second tap didn't fully solve, but greatly ameliorated, the difficulties I experienced. At this point, I'd recommend having a separate NIC in a separate slot for each tap you want to monitor, plus a separate interface for managing the box. -g On Fri, 19 Nov 2004, Patrick Marquetecken wrote:Date: Fri, 19 Nov 2004 22:16:14 +0100 From: Patrick Marquetecken <patrick.marquetecken () pandora be> To: Snort <snort-users () lists sourceforge net> Subject: [Snort-users] Advice on quad ethernet cardHi, At my work they are thinking of replacing 3 snort machines by one with a quad Ethernet card, witch will sniff 3 different lan's. The network is only 100Mbit, will there not a lot of dropped packages this way, and they must all send there data with barnyard to a remote mysql server. Is it also possible to see in the Database from witch sensor the data is from? TIA Patrick -- "Please, Spock, do me a favor ... 'n' don't say it's `fascinating'..." "No... but it is... interesting..." -- Spock Fingerprint = 2792 057F C445 9486 F932 3AEA D3A3 1B0C 1059 273B ICQ# 316932703 Registered Linux User #44550 http://counter.li.orgGlenn Forbes Fleming Larratt Rice University Networking glratt () rice edu ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Advice on quad ethernet card Patrick Marquetecken (Nov 19)
- Re: Advice on quad ethernet card Glenn Forbes Fleming Larratt (Nov 29)
- Re: Advice on quad ethernet card sekure (Nov 29)
- <Possible follow-ups>
- RE: Advice on quad ethernet card Darden, Patrick S. (Nov 19)
- RE: Advice on quad ethernet card Richard Bejtlich (Nov 19)
- Re: Advice on quad ethernet card Glenn Forbes Fleming Larratt (Nov 29)