argus and snort ?

[Carter Bullard]

So what is snort doing for you guys that is helping?
Is there some nugget of goodness that we can add to
argus that will give the same info?

Carter

-----Original Message-----
From: owner-argus at lists.andrew.cmu.edu
[mailto:owner-argus at lists.andrew.cmu.edu]On Behalf Of Russell Fulton
Sent: Monday, September 11, 2000 5:45 PM
To: argus
Subject: Re: argus and snort ?


Perhaps I should have said that I am monitoring an 10Mbps ethernet 
running at around 3Mbps in one 'direction' (inbound) and 1 Mbps in the 
other. (yes I do know that ethernet does not have any sense of 
direction ;-)  The box is an IBM Ativa with a 500Mhz processor and 
128MB ram.

Top shows Snort using about 8% of CPU and the two copies of argus are 
down below 1%.

We will soon go to 100Mbps on the DMZ and our data rates are likely to 
go up steeply when the Southern Cross fiber finally gets commissioned 
later this year.  We have been promised that prices will fall sharply 
-- I'm not holding my breath though...

Cheers.