> >I am looking for what type of resources a snort detector consumes. > > Negligible. I can paste in whatever stats you want. But it's quite minimal > IMO. Umm, how much traffic do you get :-) What are the specs of the machine running snort? IF you are switched network, what switches are you using? IF you are switched network, I assume you are using port mirroring, how is the impact on the switch? How many segments are you snorting? (Heh, insert favorite drug line here) -- Bob Tanner <tanner at real-time.com> | Phone : (952)943-8700 http://www.mn-linux.org | Fax : (952)943-8500 Key fingerprint = 6C E9 51 4F D5 3E 4C 66 62 A9 10 E5 35 85 39 D9