Re: [Snort-users] Deployment Sizes? was: anyone trying kickfire to

permalink · #1 (**permalink**) 1 Week Ago

--===============0127627846==
Content-Type: multipart/alternative;
boundary="----=_Part_15490_3818639.1209865216388"

------=_Part_15490_3818639.1209865216388
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

I figured we'd add until we start dropping too many packets. The CPU load
on each core is only about 45% right now and we're dropping less than 1% of
packets through the box. We're also doing some processor affinity stuff and
dedicating a couple cores to SQL and each instance of snort gets it's own
core as well.

I'd be interested in hearing from other folks doing large setups...

Stewart

On Sat, May 3, 2008 at 5:13 PM, Jason Haar <Jason.Haar@trimble.co.nz> wrote:

> Stewart L wrote:
> > Well, I wasn't in charge of the deployment. I handed it off to one of
> > the guys on my team to do the research and recommendations.
> >
> > Part of the problem is that there is no SOLID advice out there on how
> > to set up and tweak a lot of this stuff. We have the oreilly books
> > and have done some searches, but there is a lot of hand waving and not
> > a lot of solid answers.
>
> There are too many variables for there to be a "one size fits all"
> answer. That's why companies like SourceFire exist - they do all that
> background 'thinking' for you and produce a product that 'just works'.
>
> You should check the solution you have actually works. 6-16 100Mbs
> Ethernet monitors on one box is probably too many. Unless you've
> cherry-picked the motherboard,Ethernet cards, etc. And I'm assuming
> they're 100M - if they are Gb - you almost certainly have a problem.
>
>
> >
> > So, you're saying that if I were to have another machine do the actual
> > capture and a separate database machine, I'd be better off in the long
> > haul? That should be pretty easy to set up.
> >
> Yup - you won't get all the hard SQL work interfering with the hard
> packet sniffing work. And barnyard of course instead of native SQL
> support.
>
> --
> Cheers
>
> Jason Haar
> Information Security Manager, Trimble Navigation Ltd.
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save $100.
> Use priority code J8TL2D2.
>
> http://ad.doubleclick.net/clk;198757...un.com/javaone
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users
>

--
Stewart

The revolution will not be televised.
The revolution will be no re-run brothers;
The revolution will be live.

------=_Part_15490_3818639.1209865216388
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

I figured we'd add until we start dropping too many packets.   The CPU load on each core is only about 45% right now and we're dropping less than 1% of packets through the box.  We're also doing some processor affinity stuff and dedicating a couple cores to SQL and each instance of snort gets it's own core as well. 
 I'd be interested in hearing from other folks doing large setups... Stewart <div class="gmail_quote">On Sat, May 3, 2008 at 5:13 PM, Jason Haar <<a href="mailto:Jason.Haar@trimble.co.nz">Jason.Haar@ trimble.co.nz</a>> wrote: 
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">Stewart L wrote: 
> Well, I wasn't in charge of the deployment. I handed it off to one of 
> the guys on my team to do the research and recommendations. 
> 
> Part of the problem is that there is no SOLID advice out there on how 
> to set up and tweak a lot of this stuff.  We have the oreilly books 
> and have done some searches, but there is a lot of hand waving and not 
> a lot of solid answers. 
 
</div>There are too many variables for there to be a "one size fits all" 
answer. That's why companies like SourceFire exist - they do all that 
background 'thinking' for you and produce a product that 'just works'. 
 
You should check the solution you have actually works. 6-16 100Mbs 
Ethernet monitors on one box is probably too many. Unless you've 
cherry-picked the motherboard,Ethernet cards, etc. And I'm assuming 
they're 100M - if they are Gb - you almost certainly have a problem. 
<div class="Ih2E3d"> 
 
> 
> So, you're saying that if I were to have another machine do the actual 
> capture and a separate database machine, I'd be better off in the long 
> haul?  That should be pretty easy to set up. 
> 
</div>Yup - you won't get all the hard SQL work interfering with the hard 
packet sniffing work. And barnyard of course instead of native SQL support. 
<div><div></div><div class="Wj3C7c"> 
-- 
Cheers 
 
Jason Haar 
Information Security Manager, Trimble Navigation Ltd. 
Phone: +64 3 9635 377 Fax: +64 3 9635 417 
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 
 
 
------------------------------------------------------------------------- 
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
<a href="http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone" target="_blank">http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone</a> 
_______________________________________________ 
Snort-users mailing list 
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a> 
Go to this URL to change user options or unsubscribe: 
<a href="https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users 
Snort-users</a> list archive: 
<a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users" target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a> 
</div></div></blockquote></div> -- Stewart The revolution will not be televised. The revolution will be no re-run brothers; The revolution will be live.

------=_Part_15490_3818639.1209865216388--

--===============0127627846==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
--===============0127627846==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============0127627846==--

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode