[techtalk] Snort - Sensor and Analyst console HW config

[Angela Nash]

On my OpenBSD system right now snort is using 7MB of RAM.  I don't think you
can have one snort process listen on multiple interfaces, so you would have
to run more than one process.  I may be wrong on that, but the -i option
doesn't seem to take multiple options.

If you have to listen on 3, I'd still say 128MB is enough.

Jason

-----Original Message-----
From: Subba Rao [mailto:subba9 at home.com]
Sent: Saturday, March 24, 2001 12:26 PM
To: Angela Nash
Cc: techtalk at linuxchix.org
Subject: Re: [techtalk] Snort - Sensor and Analyst console HW config


On  0, Angela Nash <Chick at the-nashes.net> wrote:
> Snort by itself doesn't seem to use a lot of CPU.  What eats up CPU on my
> Snort system is the snortsnarf tool that takes the log information and
> outputs it to HTML reports.  A "reasonably fast" system like a Pentium II
or
> higher should work just fine.  It's not a memory hog either.  If you are
> building this box put in 128MB since it's cheap right now and you should
be
> fine.
> 
> Jason
> 
> -----Original Message-----
> From: Subba Rao [mailto:subba9 at home.com]
> Sent: Friday, March 23, 2001 4:50 AM
> To: techtalk at linuxchix.org
> Subject: [techtalk] Snort - Sensor and Analyst console HW config
> 
> 
> Hello,
> 
> I have posted the same question to Snort mailing list and did not
> get a satisfactory answer.
> 
> I am planning to deploy a Snort IDS for a client of mine. The Internet
> connection is at 256K to their ISP. What kind of processor and memory
would
> be
> recommended for a sensor with 4 NICs monitoring about 3 DMZs? There will
be
> only one analysis system. What kind of processor and memory is required on
> this
> system?
> 
> Hopefully someone here has configured HW for Snort in production.
> 

Thanks for your input. One more question, does multiple instances of snort
on
the same machine, use up memory?

-- 

Subba Rao
subba9 at home.com
http://members.home.net/subba9/

_______________________________________________
techtalk mailing list
techtalk at linuxchix.org
http://www.linux.org.uk/mailman/listinfo/techtalk