Hardware for pass 10G traffic

[nima chavooshi]

Hi

I want to setup snort in inline mode and pass 10G traffic. What hardware do you suggest for this deployment ?

Thanks in advance 

[Timothy Covel]

We looked at two possible 10G deployment options in the past:

Single System:
1 10gig NIC; 2 X Intel Xeon X5650 Westmere 2.66GHz LGA 1366 95W Six-Core Server
Processor; Kingston 12GB (6 x 2GB) 240-Pin DDR3 SDRAM DDR3 1333 ECC; 4 X Seagate Barracuda ST31000524AS 1TB 7200 RPM SATA 6.0Gb/s 3.5" Internal Hard Drive

Load Balanced System:
4 1u rackmounts with 4GB RAM, 250G disk, Intel i7 processor, 2x1G Ethernet
1 NIAGARA 4208-1SR-4TX1 10Gb Load balancer

[livio]

Hi, I wanted to give some recent, detailed performance number on the
10G appliance. We have done
some extra work to optimize its processing using Luca Deri's Direct
Nic Access (DNA) driver (5.1). The results are impressive.
New numbers using the Intel icc compiler are very encouraging. We
found that a 2 processor X5670 system can easily
sustain 5 Gbps. We run some academic traces with 4 different Snort
EmergingThreats Pro rule configurations and we are seeing < 5%
drop rate with up to 6900 rules. We are going to publish these
results through the snort and ntop mailing list soon; with
instructions on how
to reproduce the numbers. In the meantime, let me know if you have any
questions.


Livio.

[Diego Vargas]

Contracts Livio.. Very exciting work!