It sounds like FreeBSD is still the way to go for production Bro boxes. I have been very pleased with the speed and stability of FreeBSD 7, and 6.x before it. My interest in running Bro on Linux was due to some issues encountered in integrating FreeBSD into the enterprise environment I deal with. Something like RHEL is accepted a bit more by the C&A auditors since there are more defined "guidelines" for "securing" it. If that makes any sense at all.<div>
<br></div><div>Stephen</div><div><br><br><div class="gmail_quote">On Thu, Dec 4, 2008 at 8:05 PM, Richard Bejtlich <span dir="ltr"><<a href="mailto:taosecurity@gmail.com">taosecurity@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="Ih2E3d">On Thu, Dec 4, 2008 at 2:32 PM, Ken Gunderson <<a href="mailto:kgunders@teamcool.net">kgunders@teamcool.net</a>> wrote:<br>
><br>
> I should amend my FBSD statement to note that pre 5.x releases, and 4.x<br>
> in particular, served us extremely well!<br>
><br>
> --<br>
> Ken Gunderson <<a href="mailto:kgunders@teamcool.net">kgunders@teamcool.net</a>><br>
><br>
<br>
</div>Hi Ken,<br>
<br>
It might be time to try FreeBSD again. I've been running 6.x and 7.0<br>
(soon 7.1) in production for the last few years and have been happy.<br>
Early 5.x (5.0 through 5.2.1) weren't considered "STABLE" (that<br>
happened in 5.3), so I understand plenty of concerns with those<br>
releases.<br>
<br>
Sincerely,<br>
<font color="#888888"><br>
Richard<br>
</font><div><div></div><div class="Wj3C7c">_______________________________________________<br>
Bro mailing list<br>
<a href="mailto:bro@bro-ids.org">bro@bro-ids.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro</a><br>
</div></div></blockquote></div><br></div>