RE: [Snort-users] Snort on Crossbeam C30

permalink · #1 (**permalink**) 06-15-2004

This is a multi-part message in MIME format.

------_=_NextPart_001_01C45306.A62D9943
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

1) The amount of instances that Crossbeam can handle is directly
proportional to the amount of traffic Snort is monitoring. The number
of instances has nothing to do with Crossbeam (any box can run however
many instances you want). You don't really have to work with Crossbeam,
there is nothing to configure on Crossbeam. Snort's performance is
heavily impacted by CPU speed and available RAM, the Crossbeam offsets
potential performance issues with their proprietary "Network Module"
technology.
=20
2) No other issues. There really aren't issues with Crossbeam, just
with Snort itself and how many instances you want to monitor.
=20
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of
Christopher.Lewis@compucom.com
Sent: Friday, June 11, 2004 6:59 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Snort on Crossbeam C30
Sensitivity: Confidential
=20
Hello,
=20
I am trying to find out if there is any body out there that has
installed multiple instances of snort on the Crossbeam C30. I have never
worked with the Crossbeam and I am trying to find out if there are any
issues that I should know about before I begin the project.=20
1.) How many instances will the crossbeam handle? <-- Does it depend
only on the amount of ports available on the box?
2.) Any other issues that might be informative before I begin.
=20
Christopher M. Lewis, CISSP
One's first step in wisdom is to question everything - and one's last is
to come to terms with everything.=20
Georg Christoph Lichtenberg
<http://www.quotationspage.com/quotes...h_Lichtenberg/
<http://www.quotationspage.com/quotes/Georg_Christoph_Lichtenberg/> >
(1742 - 1799)
This message contains information which may be confidential and/or
privileged. Unless you are the addressee (or authorized to receive on
behalf of the addressee), you may not use, copy, or disclose to anyone
the message or any information contained in the message (including
any/all attachments). If you have received this message in error, please
advise the sender by reply e-mail, and delete/destroy this message.
=20

------_=_NextPart_001_01C45306.A62D9943
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">

<meta name=3DProgId content=3DWord.Document>
<meta name=3DGenerator content=3D"Microsoft Word 10">
<meta name=3DOriginator content=3D"Microsoft Word 10">
<link rel=3DFile-List href=3D"cid:filelist.xml@01C452DC.CF034FC0">

<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple =
style=3D'tab-interval:.5in'>

<div class=3DSection1>

<![if !supportLists]>1)       =
<![endif]>The amount of instances that Crossbeam can handle is =
directly
proportional to the amount of traffic Snort is monitoring.  The number of instances has =
nothing to do
with Crossbeam (any box can run however many instances you want).  You don’t really have to =
work with
Crossbeam, there is nothing to configure on Crossbeam.  Snort’s performance is =
heavily impacted
by CPU speed and available RAM, the Crossbeam offsets potential =
performance
issues with their proprietary “Network Module” =
technology.<o:p></o:p>

<o:p> </o:p>

2)  No other issues.  There really aren’t =
issues with
Crossbeam, just with Snort itself and how many instances you want to =
monitor.<o:p></o:p>

<o:p> </o:p>

-----Original =
Message----- 
From:
snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Christopher.Lewis@compucom.com 
Sent: Friday, June 11, =
2004 6:59
AM 
To:
snort-users@lists.sourceforge.net 
Subject: [Snort-users] =
Snort on
Crossbeam C30 
Sensitivity: =
Confidential

<o:p> </o:p>

Hello,<o:p></o:p></fo=
nt>

<o:p> </o:p></fo=
nt>

I am trying to find out if =
there is
any body out there that has installed multiple instances of snort on the
Crossbeam C30. I have never worked with the Crossbeam and I am trying to =
find
out if there are any issues that I should know about before I begin the
project. <o:p></o:p>

1.) How many instances will =
the
crossbeam handle? ß<fo=
nt size=3D2
face=3DArial> Does it =
depend
only on the amount of ports available on the =
box?<o:p></o:p>

2.) Any other issues that =
might be
informative before I begin.<o:p></o:p>

<o:p> </o:p></fo=
nt>

<div>

Christopher M. Lewis, =
CISSP<o:p></o:p>

One's first step in wisdom is to question =
everything -
and one's last is to come to terms with everything. =
<o:p></o:p>

Georg Christoph Lichtenberg =
<<a
href=3D"http://www.quotationspage.com/quotes/Georg_Christoph_Lichtenberg/=
">http://www.quotationspage.com/quotes/Georg_Chr=
istoph_Lichtenberg/</a>> (1742 - =
1799)<o:p></o:p>

This message contains information which may =
be
confidential and/or privileged. Unless you are the addressee (or =
authorized to
receive on behalf of the addressee), you may not use, copy, or disclose =
to
anyone the message or any information contained in the message =
(including
any/all attachments). If you have received this message in error, please =
advise
the sender by reply e-mail, and delete/destroy this =
message.<o:p></o:p>

</div>

<o:p> </o:p>

</div>

</body>

</html>
=00
------_=_NextPart_001_01C45306.A62D9943--

-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode