Home
| Calendar
| Mail Lists
| List Archives
| Desktop SIG
| Hardware Hacking SIG
Wiki | Flickr | PicasaWeb | Video | Maps & Directions | Installfests | Keysignings Linux Cafe | Meeting Notes | Linux Links | Bling | About BLU |
Anyone tried running Snort on a consumer-grade router? I was curious if it could be installed on a router running Tomato firmware, and ran across this: http://tomatousb.org/forum/t-305093/snort-and-dansguardian-on-tomatousb ...you must first install Optware... Then you can install Snort and Dansguardian Optware (a debian-like package management system) was expected, but I hadn't heard of DansGuardian[1], which is a "web content filter." Something I have no interest in, and I'm assuming just an optional, related tool mentioned because the OP asked about it. 1. http://dansguardian.org/?page=whatisdg More importantly another post in the same thread says: Snort, on the other hand, is FAR too memory-hungry for use on a router unless you go with a pitifully reduced ruleset. It barely fit on an otherwise-empty RT-N16 with reasonable rules defined. As I understand it, Snort relies on libpcap to inspect the packets flowing through the router. I wonder if there are any mechanisms for running libpcap on the router as usual, but running the more memory intensive packet analysis on a full server inside the LAN. This should constrain the memory footprint, though I could see such a setup still adding CPU overhead on the router if it has to send every inbound packet to two destinations. Perhaps if you don't need full packet for logging or analysis, the proxy code on the router could pass on just the packet headers. Or maybe the warning was overstated. On the next page of the thread a user reports being able to successfully run Snort on an RT-N16, but they didn't report whether they ever got custom rules working. -Tom -- Tom Metro Venture Logic, Newton, MA, USA "Enterprise solutions through open source." Professional Profile: http://tmetro.venturelogic.com/
BLU is a member of BostonUserGroups | |
We also thank MIT for the use of their facilities. |