<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Everything Michal said applies. I'll
add I did a 10gig deployment on a much older non-AVX Xeon system
and it was still functional.<br>
<br>
Re: adding Moloch to the mix; I have a plan to integrate moloch
with suricata, I just haven't had a chance to try it out yet.
This is the executive summary:<br>
<br>
1. Setup a tmpfs partition for suricata to dump pcap files into,
like /home/suri/pcap.<br>
2. Setup suricata to dump pcap to that directory, rotating by
size. I'll recommend enabling the stream/tls pruning as well. If
you have 1Gb interface you do not need to use multi mode, a single
file is fine.<br>
3. Use moloch capture in offline 'monitor mode' to monitor this
directory and copy closed files to an archive directory on disk:<br>
<br>
moloch-capture -Rm --copy --delete /home/suri/pcap <br>
<br>
Use taskset to pin this process to a core so it doesn't get
assigned to one of the suricata cores. Use a dedicated box/VM for
elasticsearch.<br>
<br>
-Coop<br>
<br>
On 3/9/2018 10:02 AM, erik clark wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAK6atxrC=cU6W1+YRyX346P13=YhAM7R7LACR+pSXX47K20ZVw@mail.gmail.com">
<pre wrap="">Hmmm, 8? Likely 16. I dont have the hardware yet, trying to prepare ahead
of time.
Would like to run about 10-15k et pro sigs.
On Fri, Mar 9, 2018 at 12:54 PM, Cooper F. Nelson <a class="moz-txt-link-rfc2396E" href="mailto:cnelson@ucsd.edu" moz-do-not-send="true"><cnelson@ucsd.edu></a> wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">How many cores?
On 3/9/2018 9:48 AM, erik clark wrote:
So, I am looking at tuning suricata as best as possible on a limited
budget. I am figuring I have about 100 meg throughput possibly, 24-48 gigs
of ram, and ideally would like to run bro on the box as well. Looks like
that may not be sufficient to do this task, and was wondering what kind of
tuning could be done to handle a load of 48 gigs of ram. I also wanted to
shove moloch on there, but I am pretty positive the system cant handle it.
SEPtun2 is clearly out of scope for this. :D
</pre>
</blockquote>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>