IDS: Re: challenges in capturing Gigabit ethernet

[Stefano Zanero <zanero () elet polimi it>]

hank.schupp () mantech-ist com wrote:
> I've tried some experiments with collecting at high-speed off gigabit
> cards.  Created a test system that generated traffic at varied rates
> from 10 mbs to 1 gbs.
What system ? On which hardware ? Which OS stack ? Which type of traffic ?

>  Though the cards themselves reported very
> little loss (Endace products) the ability to write the data to disk
Which disk ? On which bus ?

> Understand also that the tests were not done under the most
> scientific conditions - still repeated testing showed our breakdown
> was primarily the ability to write the data to disk 
hdparm -Tt (or similar) could help you pinpoint this.

-- 
Best,
Stefano Zanero
Ph.D. Student - Politecnico di Milano - Dip. Elettronica e Informazione

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------