0

I've been thinking about installing snort on my dedicated server. I got about 100 domains/clients. What should I be considering here for pros and cons? Memory usage, bandwidth impact?

1 Answer 1

2

The question is a little misleading. You first say on your web server than you say on your dedicated server.

Snort is considered a lightweight IDS though and can run on a multitude of various platforms from Windows to Unix and anything in between. I would recommend that you install it stand alone though on something like Ubuntu instead of a Windows platform. Keeping it stand alone would also not interfere with any production functions on your servers. Your IDS going down is a lot more tolerable than say your Exchange server.

Your server will need to have at least one network card that you can mirror traffic to. If you want to be able to access your Snort server via the network for management purposes, you will have to have a second network card. The network card receiving mirrored traffic will not be reachable for management. Also the NIC card should match the port it is plugged in to. A 10/100 network card will not be sufficient when plugged into a 1Gb port because it will drop so many packets. For the management interface, a 10/100 would be suitable since it is simply there for management and not for packet flow.

Although Snort in itself does not require much in the form of system requirements, the interface GUI you choose to view the data with might be if you were to use one. Snorby is a common, popular GUI interface for Snort and it has a SQL database it uses. The hard drive space would be a common concern. Going too small and having too many rule set alerts would fill up the hard drive quite quickly. If you want to actively maintain the it I would think a 120 GB drive would be good enough on a small environment. It also comes down to exactly how much traffic you will see and how many users are on the network.

Snort does not really impact bandwidth other then maybe downloading new rule sets. The mirrored port is receiving the bulk of the traffic being mirrored from the switch or router but it does not translate directly into bandwidth usage. What can happen though is if there is a large abundance of traffic coming through this device and it can not handle the load of mirroring the traffic.

2
  • yeah, that was what I was thinking. Keep it separate from my production web server. Jun 20, 2013 at 17:11
  • Definitely. Also thinking outside the box in a limited knowledge scope, but I'm sure a port scan would turn something up and give someone something to target. What's easier than using the Company's IDS to detect potential flaws in their systems?
    – Travis
    Jun 20, 2013 at 17:13

Not the answer you're looking for? Browse other questions tagged .