I've been thinking about installing snort on my dedicated server. I got about 100 domains/clients. What should I be considering here for pros and cons? Memory usage, bandwidth impact?
closed as primarily opinion-based by Falcon Momot, Dave M, Jenny D, Jacob, Bryan Jun 26 '13 at 14:50
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
The question is a little misleading. You first say on your web server than you say on your dedicated server.
Snort is considered a lightweight IDS though and can run on a multitude of various platforms from
Your server will need to have at least one network card that you can mirror traffic to. If you want to be able to access your Snort server via the network for management purposes, you will have to have a second network card. The network card receiving mirrored traffic will not be reachable for management. Also the NIC card should match the port it is plugged in to. A 10/100 network card will not be sufficient when plugged into a 1Gb port because it will drop so many packets. For the management interface, a 10/100 would be suitable since it is simply there for management and not for packet flow.
Snort does not really impact bandwidth other then maybe downloading new rule sets. The mirrored port is receiving the bulk of the traffic being mirrored from the switch or router but it does not translate directly into bandwidth usage. What can happen though is if there is a large abundance of traffic coming through this device and it can not handle the load of mirroring the traffic.