<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">1. Check out SEPTUN 1 & 2.<br>
<br>
<blockquote type="cite"><a class="moz-txt-link-freetext" href="https://github.com/pevma/SEPTun">https://github.com/pevma/SEPTun</a></blockquote>
<br>
2. Overbuild your sensor, you need a large http/stream depth to
properly track files. I would suggest 4 gigs per core if you want
to extract and hash all http files. <br>
<br>
3. Setup a BTRFS dedicated RAID 10 container with LZOP
compression to store/archive them. <br>
<br>
-Coop<br>
<br>
On 5/3/2018 8:38 AM, Carl Rotenan wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAN-RTm6L3AiO0swkCSLkSbz_3vL8uBXGEih8CSV1B5dDBhq97g@mail.gmail.com">
<pre wrap="">Hello,
What would be required to get Suricata to support 10G of traffic in IDS
mode, and extracting and hashing files on that traffic?
Thanks,
Carl
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>