[techtalk] Snort - Sensor and Analyst console HW config
Chick at the-nashes.net
Sat Mar 24 19:01:29 EST 2001
On my OpenBSD system right now snort is using 7MB of RAM. I don't think you
can have one snort process listen on multiple interfaces, so you would have
to run more than one process. I may be wrong on that, but the -i option
doesn't seem to take multiple options.
If you have to listen on 3, I'd still say 128MB is enough.
From: Subba Rao [mailto:subba9 at home.com]
Sent: Saturday, March 24, 2001 12:26 PM
To: Angela Nash
Cc: techtalk at linuxchix.org
Subject: Re: [techtalk] Snort - Sensor and Analyst console HW config
On 0, Angela Nash <Chick at the-nashes.net> wrote:
> Snort by itself doesn't seem to use a lot of CPU. What eats up CPU on my
> Snort system is the snortsnarf tool that takes the log information and
> outputs it to HTML reports. A "reasonably fast" system like a Pentium II
> higher should work just fine. It's not a memory hog either. If you are
> building this box put in 128MB since it's cheap right now and you should
> -----Original Message-----
> From: Subba Rao [mailto:subba9 at home.com]
> Sent: Friday, March 23, 2001 4:50 AM
> To: techtalk at linuxchix.org
> Subject: [techtalk] Snort - Sensor and Analyst console HW config
> I have posted the same question to Snort mailing list and did not
> get a satisfactory answer.
> I am planning to deploy a Snort IDS for a client of mine. The Internet
> connection is at 256K to their ISP. What kind of processor and memory
> recommended for a sensor with 4 NICs monitoring about 3 DMZs? There will
> only one analysis system. What kind of processor and memory is required on
> Hopefully someone here has configured HW for Snort in production.
Thanks for your input. One more question, does multiple instances of snort
the same machine, use up memory?
subba9 at home.com
techtalk mailing list
techtalk at linuxchix.org
More information about the Techtalk