[ale] Firewall discussion...hardware horsepower?

[Chris Woodfield]

Basically, the problem was that if I was logging bad packets, the CPU 
would get overloaded when a particularly large number of logged packets 
came in, such as a particularly virulent portscan. It's very possible 
that it could have been the hard drive (it's an old one, 2.5GB Maxtor, 
ATA33, no DMA), but I don't have another drive available at the moment 
to swap in.

At any rate, I recently acquired a rackmount cabinet, and I'd like to 
get something I can mount in it as opposed to just sitting a Mini-ITX 
case on a shelf; there are Mini-ITX rackmount cases, but they're 
expensive, and for the price I could buy a small standard ATX rackmount 
box and a low-end mobo/cpu combo.

Which brings me to my next question...if I'm looking for low cost and 
high power/heat efficiency, which CPU that goes with a standard ATX 
motherboard would one recommend?

Thanks,

-C

On Jul 5, 2004, at 3:19 AM, Dow Hurst wrote:

> Chris Woodfield wrote:
>
>> As an adjunct to the firewall discussion, I'm looking at upgrading 
>> mine...I'm currently running a Via EDEN 500 based box which does 
>> strict packet filtering and connection tracking fine, but starts to 
>> have issues when I turn on any sort of packet logging and/or IDS. I 
>> also would like something I can rackmount in a 1U case.
>>
>> Obviously I don't need a 3 GHz Pentium 4 and a gig a RAM for this; 
>> would would be the minimum suggested system to use here? I'm 
>> basically looking to run iptables in a one-to-one NAT config for some 
>> hosts and one-to-many NAT for others, and do blocked packet logging, 
>> snort, and some small servers (DHCP, SNMP for generating MRTG graphs, 
>> and possibly a SOCKS proxypot as well).
>>
>> Also, suggestions for cheap 1U rackmount cases are welcome as well 
>> (I'm leaning towards SuperMicro's SC512)...
>>
>>  Thanks for the input,
>>
>> -Chris
>>
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://www.ale.org/mailman/listinfo/ale
>>
> Have you checked with hdparm your disk throughput?  I am curious too 
> as to why you are having performance issues.  Is it disk or is it CPU 
> related?
> Dow
>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale