0

I'm trying to use a device with 1GB of RAM and a Single 800 MHz core CPU.
I will use Snort to analyze traffic on my LAN network. Snort, unfortunately, cannot analyze all the traffic (sometimes it triggers an alert after a trigger, sometimes not).

  • Is there a way to say "Analyze X Mbps of traffic", otherwise let the traffic flow?
  • Can you tell me where I can get a list of "reduced" RuleSet with only the most terrible attacks? Right now I just use the CRITICAL ruleset
  • Can FWSNORT be a good alternative?
  • 2
    if you go with #1, you might as well not run snort at all - better late than never? – schroeder Jun 23 '17 at 11:29
  • 1
    "critical" = "terrible" – schroeder Jun 23 '17 at 11:29
  • FWSNORT is a completely different product - we can't tell you if it is an alternative unless you state what your requirements are (and then you can likely answer that for yourself) – schroeder Jun 23 '17 at 11:30
  • 100% agree with the above comments. I would also suggest you either get a higher spec machine, or ditch SNORT. It's going to cause you more hassle trying to get it to work than the 'protection' you are aiming for. – ISMSDEV Jun 23 '17 at 11:36
  • No, I wouldn't run snort on that machine. Snort is fairly heavy and needs some decent resources. I've even had trouble running it with 2GB of RAM and 2 CPU cores on a Digital Ocean box. It would take up a majority of my resources. – Joshua Faust Jun 23 '17 at 12:45
1

It all depends on how much traffic you're attempting to monitor, but the most important factor of all your actual configuration.

There is a few actions you can do to enhance performance of your setup

  • Limit the scope of traffic to be monitored.
  • Optimize your Snort/Suricata configuration. Suricata will probably not give you much extras since it's multi-threaded and you only have one CPU core.
  • As you mentioned yourself, amount of rules implemented in your sensor have a strong performance impact. I'm not aware of any limited ruleset, but you can disable unnecessary rules yourself. There's plenty of different ruleset manager such as Polman, PulledPork. These are fairly old, and there might be more useful software/helpers for these tasks available.
  • OS level optimizations

I agree with above comments, that you want more RAM, CPU cores, strong NICs (at least two), and potentially even GPUs to get the most of your sensor setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.