After deciding to implement Snort and determining IDS sensor placement, you must decide what operating system (OS) to use for the network sensors. The answer is surprisingly simple.
Flame wars regarding relative OS performance, stability and security problems can and do erupt at the drop of a hat. With this in mind, the bottom line for determining what OS to use with a critical security device is "go with what you know." You will be much better at properly configuring, hardening, administering and troubleshooting an OS you already know. You will also be better able to spec hardware and performance, and presumably other people in your organization will be able to back you up when needed. If you and your organization are equally comfortable with multiple OSes then do some internal testing, or just pick whatever OS runs best with the hardware and IDS sensors that you plan to use.
Having said that, Snort IDS is developed and tested on Linux and Mac OS X, and is heavily tested by the Linux and BSD communities. These platforms are always supported first, and the developers are very familiar with them. With Snort on a well-tuned Linux or BSD platform you can get acceptable performance out of older, slower or cheaper hardware than some other OSes might require.
In the end, learning new technologies is something we should all do to keep current, but devices intended to protect your network are not a good place to experiment.
JP Vossen, CISSP, is a Senior Security Engineer for Counterpane Internet Security. He is involved with various open source
projects including Snort, and has previously worked as an information security consultant and systems engineer.
Rate this Tip
To rate tips, you must be a member of SearchSecurity.com. Register now
to start rating these tips. Log in if you are already a member.
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.
JP Vossen, CISSP, is a Senior Security Engineer for Counterpane Internet Security. He is involved with various open source
projects including Snort, and has previously worked as an information security consultant and systems engineer.
