I am thinking about setting up snort to act as an intrusion detection system on a machine running debian that I use as a router. Snort would be listening on the internet side (not really any significant risks, more or less just seeing what sort of activity occurs). Both of the ethernet adapters support gigabit connections (one adapter is built into the mother board while another is in an expansion slot) and the internet connection itself is about 100Mpbs (a rough estimate based on how fast I can transfer data from remote machines, this connection is inside a college dormroom). Other than occasional large file transfers (usually around one or two GB) the connection is mainly just used for browsing the web, outgoing ssh connections, etc, so there is not usually too much traffic flowing through. The machine itself is a dell optiplex 755 with a core2duo processor. Having said all of that, I was wondering if putting the nic that is connected to the internet, in promiscuous mode would cause latency to increase by a significant amount? I had done a small test and pinged a website while turning promiscuous mode on and off, and did not notice any difference in the ping times (was in ms). Also do the capabilities of the cpu affect how much latency is introduced when an interface is in promiscuous mode? Thanks for your help!
closed as off topic by EEAA, mdpc, Ward, Brent Pabst, Khaled Jan 30 '13 at 7:43
Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.
As all the traffic you are interested is IP and routed, I see no benefit in turning on the promisc mode on the interface.
Because you should not expect any traffic that is not addressed to your NIC (I assume that your ISP is using a L2 bridge or router) to be on the wire, you will see not difference in the traffic captured.
However if you would have a lot of traffic that does not have as destination your router or that is not broadcast, the traffic will be processed by the Linux kernel and, after they are processed by pcap, they will be discarded. This will increase the number of interrupts/s for the NICwith potential impact on the performance. This can be mitigated by enabling packet coalescing on the NIC.