Snort Forums Archive

Archive Home » Snort Advanced » Scaleability of Snort

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Scaleability of Snort

Posted by uber on April 13, 2005 06:52:32

Hello all
I'm in the midst of trying to help a customer who is deploying Snort to monitor an internet connection that will....ahem.....push a metric *load of traffic to and from the Internet. Suffice it to say their firewalls have special high performance nics to handle the load.
My question is:
1. Are there any rough "rule of thumbs" of how much thruput (in megs/sec) Snort can handle before it goes tits up. Just so you know I'm currently studying Snort optimization strategies...I'm just trying to find a rough performance ceiling here.
2. Since Snort is a stateful packet inspector, it must keep some kind of state table. Can the size of this state table be tweaked? Any caveats on this? Where can I look to grok the granular config details?
Thanks all!

Posted by sallgeud on April 26, 2005 07:06:13

It should be fairly easy to build a system capable of handling >2Gbps. How much are you willing to spend on hardware? The last set of sensors I built were Sun V210s (dual proc, quad gig-E). With approximately 80% of the rules enabled (as the other 20% were spurious or unnecessary for our network), and all processing plugins enabled. The systems routinely see in excess of 2-3 Gbps on a daily basis. Average system load is near 2 with no packet drops and no delays. There was only a small bit of tuning needed that involved 4 configuration lines in a file that relate to handling of packets.

I don't currently have access to the packet per second rate graphs, but will update if I get to them.

This system also did logging back to a central Oracle database, where approximately 2 dozen other sensors were also logging.

Posted by coops on November 02, 2005 17:25:57

I am in the process of investigating a 2G snort system.

Where you using scpecial gig-E cards or just the standard?

Did you customise the kernal at all?

The config changes you are referring to where they snort.conf changes?

Posted by BrandonGreenwood on November 06, 2005 15:30:44

Get some quality NIC's like Intel or 3COM.

Also don't forget about the bus taking the packets to memory/HDD. I have witnessed quad-gig ethernet running at a pretty high rate drop packets on the bus.

And yes you can gain in performance by tuning your snort.conf.