I don't think you'll get much more IPS performance from a beefier box. I'm running a quad-core VM with 8GB RAM and didn't get much performance with that upgraded from a Core2Duo single-purpose box. It has to do with the Snort engine not capable of supporting multiple cores (unless multiple instances of Snort are run). I've had some success not losing a whole bunch of throughput enabling rule age to be >12 mos.
With Copernicus, I'm only seeing ~3MB/s throughput in speedtests. I know they're not wholly accurate but that was pretty surprising to see. I'll play with it more this week to see if I can do it just a little bit better.
Overall, love the redesign and looking forward to the production service. Hope they settle on 2C/8GB for the home license with no IP address restrictions (or maybe 75 or 100 limit) for the home license. That'd be swell.
I don't think you'll get much more IPS performance from a beefier box. I'm running a quad-core VM with 8GB RAM and didn't get much performance with that upgraded from a Core2Duo single-purpose box. It has to do with the Snort engine not capable of supporting multiple cores (unless multiple instances of Snort are run). I've had some success not losing a whole bunch of throughput enabling rule age to be >12 mos.
With Copernicus, I'm only seeing ~3MB/s throughput in speedtests. I know they're not wholly accurate but that was pretty surprising to see. I'll play with it more this week to see if I can do it just a little bit better.
Overall, love the redesign and looking forward to the production service. Hope they settle on 2C/8GB for the home license with no IP address restrictions (or maybe 75 or 100 limit) for the home license. That'd be swell.
