[ug-crosug] Open Solaris & Snort

[Timothy Kennedy]

The overall network performance of Solaris has improved significantly
in the last few years, with the advent of Solaris 10 and Project
FireEngine.

Solaris 10 completely rewrote the network stack from the ground up, with
a real design effort to improve network performance over Solaris 8 and
9 x86.

As long as you have decent hardware, I don't see any reason why you
couldn't run a decent snort machine on Solaris 10 x86.  Solaris 10
is a *world* of difference from Solaris 8 x86.

http://www.sun.com/software/solaris/ds/network_performance.jsp

-Tim

Arif Basha wrote:
> Hello friends,
> 
> I am on Snort list and noticed a message today regarding comparison of
> Linux and Open Solaris.  Part of the email thread is, below.  Please
> let me know if anyone has any experience or comments on this.
> 
> Thanks for your time.
> Arif
> Sun Campus Ambassador @ GMU
>  
> 
> 
> ------------------
>>> I haven't looked at Solaris performance in years but as I recall the
>>> packet acquisition on the OS was very slow compared to linux and the
>>> BSD's.
>>>
>>>        -Marty
>>>
>>> On Oct 16, 2007, at 8:45 AM, sekure wrote:
>>>
>>>> Bump...
>>>>
>>>> Anybody have any opinion?  Anyone want to take a guess?
>>>>
>>>> ---------- Forwarded message ----------
>>>> From: sekure <sekure at gmail.com>
>>>> Date: Oct 12, 2007 1:40 PM
>>>> Subject: Snort performance on Solaris 10 x86
>>>> To: Snort Users <snort-users at lists.sourceforge.net>
>>>>
>>>>
>>>> Has anyone done any benchmarking for snort performance on Solaris 10
>>>> x86 vs. Linux or BSD?
>>>>
>>>> I am currently running snort 2.4.2 on RedHat on 3 year old HP DL360
>>>> with Phil Wood's mmapped libpcap library, and handling 30-40 Mbps
>>>> pretty comfortably.  In the past I had problems capturing 1/10th of
>>>> that on Solaris 8 with comparable Sparc hardware, CPU would go
>>>> through the roof, packets dropped on the floor.
>>>>
>>>> The hardware warranty is about to expire and I am going to have to
>>>> upgrade. The Unix admins at my company are pushing me to migrate to
>>>> Solaris 10 x86, since it's easier for them to maintain, and
>>>> personally i don't mind, IF the performance is there.  But I can't
>>>> seem to find anything on this list or anywhere for that matter with
>>>> regards to Snort performance on Solaris 10.
>>>>
>>>> I can certainly undertake the testing myself, but I thought I'd ask
>>>> the list first.  So, anyone running Snort on Solaris 10 at any
>>>> significant speeds? Any special tweeks to make it work? Or should I
>>>> just stick with what works?
>>>>
>>>> Thanks in advance.
> -----------------------------
> _______________________________________________
> ug-crosug mailing list
> ug-crosug at opensolaris.org
> http://mail.opensolaris.org/mailman/listinfo/ug-crosug

-- 
       /\        Timothy Kennedy
       \ \       IT Technologist V
    / \ \ /      GCS Infrastructure Management (GCSIM)
   / /\\// /\    Tier-3 Infrastructure OS Team
   \/ //\\/ /    Email:  Timothy.Kennedy at Sun.COM
     / \ \ /     Phone:  +1-703-636-0531
      \ \        AIM:    tkSUNW
       \/        WWW:    http://blogs.sun.com/tkblog