Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Embedded hardware for snort

    Scheduled Pinned Locked Moved Hardware
    17 Posts 5 Posters 6.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      ozlecz
      last edited by

      hello,
      =is embedded hardware recommended at all for soho snort implementation? if not, what is your recommendation?
      =is it possible at all to implement an alix2d13 (alix2d3 = 3 LAN / 1 miniPCI / LX800 / 256 MB / USB) on this scenario?

      thanks

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        @ozlecz:

        hello,
        =is embedded hardware recommended at all for soho snort implementation? if not, what is your recommendation?
        =is it possible at all to implement an alix2d13 (alix2d3 = 3 LAN / 1 miniPCI / LX800 / 256 MB / USB) on this scenario?

        thanks

        256 MB of RAM is woefully inadequate for even a modest Snort rule set.  Snort will easily consume 2 GB or even 4 GB of RAM with a moderately comprehensive rule set.  So I would not recommend running Snort on the hardware you listed.

        Bill

        1 Reply Last reply Reply Quote 0
        • O
          ozlecz
          last edited by

          the new Alix APU.1c4 now comes with 4GB.. wont this be enough for a 50 user organization

          1 Reply Last reply Reply Quote 0
          • A
            asterix
            last edited by

            @ozlecz:

            the new Alix APU.1c4 now comes with 4GB.. wont this be enough for a 50 user organization

            The CPU is not powerful enough. It is possible to run on it (may be) but don't expect reasonable responses on page loads

            Snort could run on 2GB if you relax the rules down to the bare minimum. Once rules are loaded in RAM, the CPU takes a hit on processing them against every bit of information going back and forth the firewall.

            1 Reply Last reply Reply Quote 0
            • O
              ozlecz
              last edited by

              so do you know then any fanless embedded hardware that would run snort..target network is SMB..thx

              1 Reply Last reply Reply Quote 0
              • A
                asterix
                last edited by

                I haven't tested the latest Atom processors. Some folks have got Snort to work on the earlier Atom models as well but I doubt the performance is worth going that route.

                Why are you looking for embedded hardware? Is it becasue of space contraints?

                You could assemble a simple 1U enclosure with a Celeron or i3 processor with a passive heat sink on it. That would be the best possible scenario as the Celeron/i3 will have the necessary power plus extra CPU cycles to spare in case in future you wish to do more on that box. A passive heat sink with a a picPSU should be super quiet.

                Check this out…

                http://www.mini-box.com/M350S-enclosure-with-picoPSU-80-and-60W-adapter

                1 Reply Last reply Reply Quote 0
                • J
                  jasonlitka
                  last edited by

                  @asterix:

                  I haven't tested the latest Atom processors. Some folks have got Snort to work on the earlier Atom models as well but I doubt the performance is worth going that route.

                  Why are you looking for embedded hardware? Is it becasue of space contraints?

                  You could assemble a simple 1U enclosure with a Celeron or i3 processor with a passive heat sink on it. That would be the best possible scenario as the Celeron/i3 will have the necessary power plus extra CPU cycles to spare in case in future you wish to do more on that box. A passive heat sink with a a picPSU should be super quiet.

                  Check this out…

                  http://www.mini-box.com/M350S-enclosure-with-picoPSU-80-and-60W-adapter

                  The Atom N2800 I'm phasing out at home seems to max out at around 50Mbit/s with the Snort rules I use.  I've got much higher hopes for my new C2758.

                  I can break anything.

                  1 Reply Last reply Reply Quote 0
                  • A
                    asterix
                    last edited by

                    8 Cores may sound promising but I doubt it would be a huge difference. Atoms are not meant to do heavy processing. Plain vanilla pfSense will work great for basic home use.

                    Check this out.

                    http://www.neweggbusiness.com/Product/Product.aspx?gclid=CJSdjOuFsb0CFaVQOgodZBUAiw&Item=9B-13-182-855&nm_mc=KNC-GoogleBiz&cm_mmc=KNC-GoogleBiz--pla--Server+Motherboards-_-9B-13-182-855&ef_id=Uy4ydQAAAaRIQhwV:20140326203218:s

                    Looks great with Quad Gigabit NICs. Worth a shot :)

                    1 Reply Last reply Reply Quote 0
                    • P
                      priller
                      last edited by

                      I just got that SuperMicro A1SRi-2758F.  Really, really nice.  It's practically purpose-made for a networking implementation.  Pretty much on idle with Snort and Suricata running.

                      1 Reply Last reply Reply Quote 0
                      • J
                        jasonlitka
                        last edited by

                        @asterix:

                        8 Cores may sound promising but I doubt it would be a huge difference. Atoms are not meant to do heavy processing. Plain vanilla pfSense will work great for basic home use.

                        Check this out.

                        http://www.neweggbusiness.com/Product/Product.aspx?gclid=CJSdjOuFsb0CFaVQOgodZBUAiw&Item=9B-13-182-855&nm_mc=KNC-GoogleBiz&cm_mmc=KNC-GoogleBiz--pla--Server+Motherboards-_-9B-13-182-855&ef_id=Uy4ydQAAAaRIQhwV:20140326203218:s

                        Looks great with Quad Gigabit NICs. Worth a shot :)

                        I'm not sure what your point was.  You said an Atom isn't enough and then posted the very same Atom board I've got here as a replacement for my DN2800MT.  The Avoton/Rangeley cores are significantly faster than the older Atoms.  They really should have changed the name.

                        I can break anything.

                        1 Reply Last reply Reply Quote 0
                        • A
                          asterix
                          last edited by

                          @Jason:

                          @asterix:

                          8 Cores may sound promising but I doubt it would be a huge difference. Atoms are not meant to do heavy processing. Plain vanilla pfSense will work great for basic home use.

                          Check this out.

                          http://www.neweggbusiness.com/Product/Product.aspx?gclid=CJSdjOuFsb0CFaVQOgodZBUAiw&Item=9B-13-182-855&nm_mc=KNC-GoogleBiz&cm_mmc=KNC-GoogleBiz--pla--Server+Motherboards-_-9B-13-182-855&ef_id=Uy4ydQAAAaRIQhwV:20140326203218:s

                          Looks great with Quad Gigabit NICs. Worth a shot :)

                          I'm not sure what your point was.  You said an Atom isn't enough and then posted the very same Atom board I've got here as a replacement for my DN2800MT.  The Avoton/Rangeley cores are significantly faster than the older Atoms.  They really should have changed the name.

                          LOL. My point was if embedded hardware is what the OP really wanted then he could try this…. based on your recommendation of C2758.

                          1 Reply Last reply Reply Quote 0
                          • A
                            asterix
                            last edited by

                            @priller:

                            I just got that SuperMicro A1SRi-2758F.  Really, really nice.  It's practically purpose-made for a networking implementation.  Pretty much on idle with Snort and Suricata running.

                            Have you loaded all of Snort rules just to test it? If not, could you please load the entire list of Snort rules and do a speed test to see how much bandwidth is available with this new Atom processor.

                            It looks good to me but way too expensive for an Atom at the moment.

                            1 Reply Last reply Reply Quote 0
                            • J
                              jasonlitka
                              last edited by

                              @asterix:

                              @priller:

                              I just got that SuperMicro A1SRi-2758F.  Really, really nice.  It's practically purpose-made for a networking implementation.  Pretty much on idle with Snort and Suricata running.

                              Have you loaded all of Snort rules just to test it? If not, could you please load the entire list of Snort rules and do a speed test to see how much bandwidth is available with this new Atom processor.

                              It looks good to me but way too expensive for an Atom at the moment.

                              Using the "Balanced VRT" ruleset, plus a dozen group selections from ET, my DN2800MT hit 100% on a single core from snort at ~48Mbit/s.  The C2758 maxes my FiOS at 83Mbit/s with snort at 20% of a single core.  Assuming that it scales up linearly, that would put it at a cap of 400Mbit/s, just about right since I've seen numbers of 5-10x the speed of the previous generation depending on the task.

                              Snort is supposed to be able to take advantage of QuickAssist but I've no idea if it actually is.  If not, there's more progress to be made here.

                              EDIT: Updated C2758 with "real world" snort percentage & throughput estimate.  I'm not sure what speedtest.net does, but it drives snort nuts…

                              I can break anything.

                              1 Reply Last reply Reply Quote 0
                              • A
                                asterix
                                last edited by

                                Hmm.. so I suppose sticking with an i3/i5 is still best for faster routing speeds. I doubt the annual power consumption difference in terms of $$  between the latest Atom and i3 are going to be that huge.

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jasonlitka
                                  last edited by

                                  @asterix:

                                  Hmm.. so I suppose sticking with an i3/i5 is still best for faster routing speeds. I doubt the annual power consumption difference in terms of $$  between the latest Atom and i3 are going to be that huge.

                                  Depends.  If you're talking about two interface FW performance then yes, a dual-core i3 with a high clock speed is going to walk all over it.  If you're talking about running it as a "router" with 4, 6, 8 or more interfaces, and you plan to use snort on those interfaces, I suspect the C2758 will come out ahead.

                                  I can break anything.

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    asterix
                                    last edited by

                                    Shouldn't Snort running on multiple interfaces need to have rules loaded for each of those interfaces, which in turn require more RAM for loading rules?

                                    How do I make pfSense run just as a "router". Isn't it functioning as a firewall and a router at the same time?

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jasonlitka
                                      last edited by

                                      Yeah, but RAM is cheap.  The new box I put in at home has 16GB now with room to expand to 32GB. Once 16GB SODIMMs are available I could bump to 64GB.

                                      If you don't want to run snort then don't install it.

                                      I can break anything.

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.