Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been thinking about installing snort on my dedicated server. I got about 100 domains/clients. What should I be considering here for pros and cons? Memory usage, bandwidth impact?

share|improve this question

closed as primarily opinion-based by Falcon Momot, Dave M, Jenny D, Jacob, Bryan Jun 26 '13 at 14:50

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

The question is a little misleading. You first say on your web server than you say on your dedicated server.

Snort is considered a lightweight IDS though and can run on a multitude of various platforms from Windows to Unix and anything in between. I would recommend that you install it stand alone though on something like Ubuntu instead of a Windows platform. Keeping it stand alone would also not interfere with any production functions on your servers. Your IDS going down is a lot more tolerable than say your Exchange server.

Your server will need to have at least one network card that you can mirror traffic to. If you want to be able to access your Snort server via the network for management purposes, you will have to have a second network card. The network card receiving mirrored traffic will not be reachable for management. Also the NIC card should match the port it is plugged in to. A 10/100 network card will not be sufficient when plugged into a 1Gb port because it will drop so many packets. For the management interface, a 10/100 would be suitable since it is simply there for management and not for packet flow.

Although Snort in itself does not require much in the form of system requirements, the interface GUI you choose to view the data with might be if you were to use one. Snorby is a common, popular GUI interface for Snort and it has a SQL database it uses. The hard drive space would be a common concern. Going too small and having too many rule set alerts would fill up the hard drive quite quickly. If you want to actively maintain the it I would think a 120 GB drive would be good enough on a small environment. It also comes down to exactly how much traffic you will see and how many users are on the network.

Snort does not really impact bandwidth other then maybe downloading new rule sets. The mirrored port is receiving the bulk of the traffic being mirrored from the switch or router but it does not translate directly into bandwidth usage. What can happen though is if there is a large abundance of traffic coming through this device and it can not handle the load of mirroring the traffic.

share|improve this answer
yeah, that was what I was thinking. Keep it separate from my production web server. – needle_in_thestack Jun 20 '13 at 17:11
Definitely. Also thinking outside the box in a limited knowledge scope, but I'm sure a port scan would turn something up and give someone something to target. What's easier than using the Company's IDS to detect potential flaws in their systems? – Travis Jun 20 '13 at 17:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.