Intrusion Detection Suricata or SNORT?

[anon82920800]

@Thovthe

Part of the reason I wanted such a high performance router.

Be wary of your expectations in this regard

@anon82920800

Reading the various related threads it looks like that inherent penalties take users (repeatedly) by surprise, kind of unawareness to the correlation of the CPU (capabilities) vs. high bandwidth throughput (reaching/exceeding 1 GbE connectivity) vs. DPI (vs. any additional apps/services that require CPU cycles).

It is also not clear to which extent Suricata on its own is contributing to the performance degradation (probably the lion share) vs. what PAKON might contribute on its own.

Another unknown is the performance (potential improvements) of Suricata v5.0.x vs. the legacy v4.0.x that is provided by TOS.

Similar [OpenWrt Wiki] Snort

SNORT takes an absurd amount of memory and processing power with rules, BEWARE.

---

@Thovthe

It also seems that (other than beta SNORT++ on TOS 5) the packages for both and a little out of date, I’m not sure how big of an issue that might be.

Snort packaging is maintained upstream and not high on their agenda Layer 7 Firewall on Openwrt - #2 by juppin - Installing and Using OpenWrt - OpenWrt Forum

There are the famous snort and snort3 packages as intrusion detection system, but they are hard to maintain and probably a bit overkill on low powered router devices.