Hi all,
Because we have made changes in our perimeter networks, I need to migrate my two Bro-IDS sensors based on CentOS to FreeBSD OS but it raises some doubts.
a) What is the best option: FreeBSD 9.1 or 8.4??
b) Kernel options to monitor 1 GiB networks (ipc,buffers,etc)??
Many thanks for your help in advance.
Please, any tip??
I would use FreeBSD 9.1. It has built in support for gpart (the default for the new installer) so it can handle disks larger than 2TB (which you will likely have) and has numerous improvements to the network stack as well as many of the network card drivers.
I can't answer the second question since I use the defaults, but there are pages on the internet describing how to turn the kernel for high speed network performance - like this one - <https://wiki.freebsd.org/NetworkPerformanceTuning>
Many thanks Paul. I am testing Fbsd 9.1 amd64 now and I will see how it
goes ...