Which snort rules to use? How much ram?
-
Hey guys, just wanted to say that pfsense is new to me and seems great so far. I've migrated here from ipcop. It took me awhile to get snort working, but I finally figured out the problem. It seems that I was enabling too many rule categories perhaps? I would start the snort service, then it would say that snort has started, but it clearly wasn't. I dropped the number of rule categories back, and now snort starts fine. It is using 75% of my 1gig of ram when snort is on. How many categories should I be able to select, and which ones are "essential" Should snort be using that much ram on say…..5-6 categories selected? I know it depends on the categories and how many rules they have, but I anticipated less hardware dependency for so few categories selected.
Thanks guys for the advice!