[ug-crosug] Open Solaris & Snort

[Arif Basha]

Hello friends,

I am on Snort list and noticed a message today regarding comparison of
Linux and Open Solaris.  Part of the email thread is below.  Please
let me know if anyone has any experience or comments on this.

Thanks for your time.
Arif
Sun Campus Ambassador @ GMU



------------------
> >
> > I haven't looked at Solaris performance in years but as I recall the
> > packet acquisition on the OS was very slow compared to linux and the
> > BSD's.
> >
> >        -Marty
> >
> > On Oct 16, 2007, at 8:45 AM, sekure wrote:
> >
> > > Bump...
> > >
> > > Anybody have any opinion?  Anyone want to take a guess?
> > >
> > > ---------- Forwarded message ----------
> > > From: sekure <sekure at gmail.com>
> > > Date: Oct 12, 2007 1:40 PM
> > > Subject: Snort performance on Solaris 10 x86
> > > To: Snort Users <snort-users at lists.sourceforge.net>
> > >
> > >
> > > Has anyone done any benchmarking for snort performance on Solaris 10
> > > x86 vs. Linux or BSD?
> > >
> > > I am currently running snort 2.4.2 on RedHat on 3 year old HP DL360
> > > with Phil Wood's mmapped libpcap library, and handling 30-40 Mbps
> > > pretty comfortably.  In the past I had problems capturing 1/10th of
> > > that on Solaris 8 with comparable Sparc hardware, CPU would go
> > > through the roof, packets dropped on the floor.
> > >
> > > The hardware warranty is about to expire and I am going to have to
> > > upgrade. The Unix admins at my company are pushing me to migrate to
> > > Solaris 10 x86, since it's easier for them to maintain, and
> > > personally i don't mind, IF the performance is there.  But I can't
> > > seem to find anything on this list or anywhere for that matter with
> > > regards to Snort performance on Solaris 10.
> > >
> > > I can certainly undertake the testing myself, but I thought I'd ask
> > > the list first.  So, anyone running Snort on Solaris 10 at any
> > > significant speeds? Any special tweeks to make it work? Or should I
> > > just stick with what works?
> > >
> > > Thanks in advance.
-----------------------------