SNORT on embeded

  • Hey guys just wondering if theres a way to get SNORT on the embeded systems easily enough, im trying to convince my work to use PFSense but they want it in a network appliance form..not 1u server so we are looking at wrap boards to run PFSense+SNORT to be a monitoring node on a switchs SPAN port..any ideas?

  • 1. Packages are disabled on embedded systems.
    2. Snort requires 1 GB of ram, which most embedded systems do not have.

    You can certainly build a small computer that will run the live cd version. Micro ATX Motherboards work very well for this setup.

    I currently have a micro atx computer running 1.0.1 with 1GB ram and a p4 processor. Its in the following case
    which is fairly small. Works like a charm. I have 4 Nics and a wireless card.

  • thanks…but that box is way too big to be a net appliance on rack...looking for a soekris or wrap size computer with 2 nics or a single dualport and maybe ive ran a snort system on a 128mb RAM machiene..any reason why its so picky with PfSense? ive noticed even on a full tower 700mhz P3 it needs over 128 to not kernel panic at me

  • Not sure, Scott will have to chime in on that.

  • Bump, scott any ideas?

  • Ask the Snort guys.  I really don't know.

Log in to reply