Re: [Snort-users] Snort speed limit?

At 02:02 PM 5/11/2004, Sheahan, Paul wrote:
>I have a Snort sensor on a Gigabit network. Is there a theoretical speed
>limit at which Snort can no longer keep up? For example, the wire can
>handle gigabit but say our traffic level is half of that. Is there a
>theoretical limit to what Snort can handle assuming the beefiest hardware?

There's no inherent limits in the speed of snort, it's entirely limited by
your hardware and configuration. (obviously the more rules, preprocessors,
etc you use the more hardware resources snort will chew up for a given flow
of traffic.)

The fact that sourcefire's NS3000 is rated for monitoring real gigabit data
thruput with 0% packet loss suggests wire-speed gig-e is definitely
possible right now with the right hardware and tuning.




-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg...rom=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users