[Oisf-users] HTTP Sessions and resource estimation

[Peter Manev]

On Wed, Mar 18, 2015 at 10:14 PM, Yasha Zislin <coolyasha at hotmail.com> wrote:
> Not sure if this question was already asked or not.
> Let's say I have pure http traffic (like 99% of the whole traffic). The pipe
> is 10 gigs but utilization is couple of gigs but it might grow.
> To my understanding, Suricata inspecting this feed would use most of its
> memory on HTTP sessions.
> Is there a way to estimate how much RAM (resources) I would need if
> throughput and type of traffic is known?
>
>
> I can definitely provide some config snippets of mine. Just let me know
> which ones.
>

What does the average session look  like - do you have big file/video
transfers for example?

> Thank you.
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Training now available: http://suricata-ids.org/training/



-- 
Regards,
Peter Manev