On my OpenBSD system right now snort is using 7MB of RAM. I don't think you
can have one snort process listen on multiple interfaces, so you would have
to run more than one process. I may be wrong on that, but the -i option
doesn't seem to take multiple options.
If you have to listen on 3, I'd still say 128MB is enough.
Jason
-----Original Message-----
From: Subba Rao [mailto:[EMAIL PROTECTED]]
Sent: Saturday, March 24, 2001 12:26 PM
To: Angela Nash
Cc: [EMAIL PROTECTED]
Subject: Re: [techtalk] Snort - Sensor and Analyst console HW config
On 0, Angela Nash <[EMAIL PROTECTED]> wrote:
> Snort by itself doesn't seem to use a lot of CPU. What eats up CPU on my
> Snort system is the snortsnarf tool that takes the log information and
> outputs it to HTML reports. A "reasonably fast" system like a Pentium II
or
> higher should work just fine. It's not a memory hog either. If you are
> building this box put in 128MB since it's cheap right now and you should
be
> fine.
>
> Jason
>
> -----Original Message-----
> From: Subba Rao [mailto:[EMAIL PROTECTED]]
> Sent: Friday, March 23, 2001 4:50 AM
> To: [EMAIL PROTECTED]
> Subject: [techtalk] Snort - Sensor and Analyst console HW config
>
>
> Hello,
>
> I have posted the same question to Snort mailing list and did not
> get a satisfactory answer.
>
> I am planning to deploy a Snort IDS for a client of mine. The Internet
> connection is at 256K to their ISP. What kind of processor and memory
would
> be
> recommended for a sensor with 4 NICs monitoring about 3 DMZs? There will
be
> only one analysis system. What kind of processor and memory is required on
> this
> system?
>
> Hopefully someone here has configured HW for Snort in production.
>
Thanks for your input. One more question, does multiple instances of snort
on
the same machine, use up memory?
--
Subba Rao
[EMAIL PROTECTED]
http://members.home.net/subba9/
_______________________________________________
techtalk mailing list
[EMAIL PROTECTED]
http://www.linux.org.uk/mailman/listinfo/techtalk
_______________________________________________
techtalk mailing list
[EMAIL PROTECTED]
http://www.linux.org.uk/mailman/listinfo/techtalk
