I just found this cool intel network card, while reading its spec of which it is actually based on Endace encap, I would like to know anybody have experience with this card - Intel Pro/1000mt Server adapter. It seems to be great network adapter to use for network security monitoring purpose as we all know Endace is a vendor that providing hardware which plays well with Open Source Tools. Here's the infos of the network adapter -
http://www.endace.com/enCap.html#
http://www.endace.com/enCap.html#
http://www.intel.com/network/connectivity/products/pro1000mt_server_adapter.htm
I plan to get this adapter and install it on FreeBSD box. Please do share your experience if you have one, it would be glad to hear from you.
Cheers :]
3 comments:
I'm not fully convinced that an Endace DAG card is needed for 1 gigabit. I was recently evaluating a DAG with a 1 gig test setup. We also evaluated a PF_RING on Intel NICs (this is Linux). Both were able to capture the full gig at full packet sizes.
And they were very close as we started to add more Snort rules as well, both being able to do about 500Mbps without dropping any packets.
Obviously Snort is the bottleneck here, but we didn't see much advantage in going to the Endace card for gig-e. Perhaps over 1 gig things might change.
Maybe stress test the card will know it better :]
Anyway thanks for the feedback. Cheers.
can you offer the encap kernel driver which is under gpl?
endace did not answer my request.
Post a Comment