[Oisf-users] Low End Hardware

[Cooper F. Nelson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

A good rule of thumb is that if you want to run the full ET feed you
need 1 core per 50 mbit of traffic.

On 4/21/2015 4:27 AM, Peter Fyon wrote:
> Hey everyone,
> 
> I'm looking to upgrade my snort setup at home to suricata. At the same
> time, I'm planning on upgrading hardware.
> 
> Unfortunately, the only benchmarks I can find are from back in 2011 or
> for setups handling substantially more traffic than I need (10gbit).
> 
> I was hoping some of you could give me examples of the hardware you're
> using, number of signatures, and the throughput you see.
> 
> My current box is an old netbook with a first gen atom cpu. With snort +
> nfqueue and 20000 signatures, it starts dropping packets around 25 mbit
> and multiple sessions. My ideal box would be able to handle
> ~700-1000mbit, with fewer signatures.
> 
> On the note of hardware, is it better to focus on more cores or higher
> cpu speed?
> 
> Thanks,
> Peter
> 
> 
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net
> 


- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iQEcBAEBAgAGBQJVNoX/AAoJEKIFRYQsa8FWp/gH/3LH1iJTYR1qDXXKV3niXX5x
3OLN5dPOZoFHqALur2SuyYrL2BwpfR+wahIiaT8mem8rvw5g1wt/36clDi+nvZ8R
5yFcs2tpFj0xhFrt08Vucn+Mx+M22d8+Q8F4sHJEx7hYtr4/c4/K88rXUHjwprBH
0jRYdrYYcizBamIbj3bx6eth7Mhj/xifeiJXB2ONtrMDZgs6Iy1zD8qxhc1OTwuM
4sao0dfdCQvoWQj9XgAbwR8lPz3Xhl0oyCM8xg9ndfwbNa6F2pyF2sgFwkXgOU/m
Wa2LHdwq6g1IzB5wYc7blFeFov1Pqwyz/rBf8qknJCrUCBZ/fsIsdaZ0bJ50kwo=
=72Ks
-----END PGP SIGNATURE-----