Finding an OS for Snort IDS sensors

JP Vossen offers his advice on choosing an OS for Snort sensors.

After deciding to implement Snort and determining IDS sensor placement, you must decide what operating system (OS)

to use for the network sensors. The answer is surprisingly simple.

More Information

Learn how to harden your Unix/Linux OS with this expert advice

Find out how to keep your Mac OS secure with these resources

Flame wars regarding relative OS performance, stability and security problems can and do erupt at the drop of a hat. With this in mind, the bottom line for determining what OS to use with a critical security device is "go with what you know." You will be much better at properly configuring, hardening, administering and troubleshooting an OS you already know. You will also be better able to spec hardware and performance, and presumably other people in your organization will be able to back you up when needed. If you and your organization are equally comfortable with multiple OSes then do some internal testing, or just pick whatever OS runs best with the hardware and IDS sensors that you plan to use.

Having said that, Snort IDS is developed and tested on Linux and Mac OS X, and is heavily tested by the Linux and BSD communities. These platforms are always supported first, and the developers are very familiar with them. With Snort on a well-tuned Linux or BSD platform you can get acceptable performance out of older, slower or cheaper hardware than some other OSes might require.

In the end, learning new technologies is something we should all do to keep current, but devices intended to protect your network are not a good place to experiment.


SNORT INTRUSION DETECTION AND PREVENTION GUIDE

  Introduction
  Why Snort makes IDS worth the time and effort
  How to identify and monitor network ports after intrusion detection
  How to handle network design with switches and segments
  Where to place IDS network sensors
  Finding an OS for Snort sensors
  How to determine network interface cards for IDS sensors
  Modifying and writing custom Snort IDS rules
  How to configure Snort variables
  Where to find Snort IDS rules
  How to automatically update Snort rules
  How to decipher the Oinkcode for Snort's VRT rules
  Using IDS rules to test Snort

ABOUT THE AUTHOR:
JP Vossen, CISSP, is a Senior Security Engineer for Counterpane Internet Security. He is involved with various open source projects including Snort, and has previously worked as an information security consultant and systems engineer.

This was first published in May 2005

Dig deeper on Network Intrusion Detection (IDS)

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close