Considering using snort

[Guy <wyldfury () gmail com>]

Hi,

One of our old boxes (set up by a previous sys admin) has snort on it.
It's about to be reinstalled, so before I include snort in the
reinstall I'd just like to find out one or two things.

The machine it's currently on is a load balancer, so most of our
traffic hits one of the load balancers before going on to other
servers. But, due to the way our hosting company provides machines,
all our other servers can be accessed directly from the internet, even
though we use the LAN for most data transfer.

What sort of load (CPU,RAM and I/O) does snort add to a server as some
of our servers already have fair load doing mail, mail scanning, etc?
I'm curious whether Snort would be usable on all our servers or would
be better to only have on the main entry points, the load balancers,
since they're not running heavy services.

Any other advice about this would be appreciated.

Thanks
Guy

-- 
Don't just do something...sit there!

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users