Re: [Snort-inline-users] First snort inline config - req suggestions on hardware, version of software

[Lance S. <la...@ho...>]

On Tue, 13 May 2003 rob...@di... wrote:

> I am in the process of setting up a demo honeynet, and am installing and 
> using the snort_inline/GenII configuration for the first time.
> 
> I was wondering if anyone would share the hardware configuration of their 
> gateway PC with me - just how much processor power and memory is required to 
> front end a small (max 4 honeypots) honeynet?

Minimal.  You can easily get away with an old Pentium and 64 MB of
RAM. Remember, Honeynets in general only collect malicious or
unauthorized traffic, so you should see no more then 5 MB of traffic
a day (unless you are compromised, then the captured activity
definitely increases).  The biggest challenge will be getting your 
system to work with several NICs.  Also, any Linux distribution should 
work fine.

If anyone has different findings, I would definitely be interested
in their experiences.

lance