|Main Archive Page > Month Archives > snort-users archives|
I'm looking into beefing up my snort sensor system, and one of the things I'm looking at is a aggregating network tap, to take the four wan links I'm currently monitoring and sending that traffic to the snort sensor NIC. I'm concerned that the snort sensor won't be able to handle the traffic (which would be below 1gb/s but still could be quite high (up to 400 gb/s) maybe. I'm in a position to be able to buy new hardware, and was wondering what you'd recommend. I most likely will need to buy an HP server. What about the Endace NICs? Anyone using them with Snort, and what's your experience been if so ?