installing snort on high traffic gateway bog it down?

kcorupe · 04-04-2007, 06:19 PM

Would running snort on a gateway with squid be to much for it to handle? I would prob send the logs to my own machine vs keeping them on there.

The box is a 2.0ghz P4 - 2 gigs of RAM, and 500gigs of hd space (mostly for squid cache).

I live in a house with 35 guys, and there is a lot of web traffic. I installed squid and shorewall with traffic shaping to help speed things up, but I don't want to load down the machine.

win32sux · 04-06-2007, 03:15 AM

Moved: This thread is more suitable in Linux - Server and has been moved accordingly to help your thread/question get the exposure it deserves.

lord-fu · 04-06-2007, 08:02 AM

I use it in locations with hundreds of users on some machines much smaller than that and never had an issue. Most of the time I store the logs in mysql, but keeping logs off the machine is very wise. IMHO I think you will be fine.