[Bro] Recommendations for install Bro under FreeBSD

[Paul Schmehl]

--On April 17, 2013 5:59:21 AM +0000 "C. L. Martinez" 
<carlopmart at gmail.com> wrote:

>
> On Tue, Apr 16, 2013 at 9:02 AM, C. L. Martinez <carlopmart at gmail.com>
> wrote:
>
>
> Hi all,
>
>
>  Because we have made ​​changes in our perimeter networks, I need to
> migrate my two Bro-IDS sensors based on CentOS to FreeBSD OS but it
> raises some doubts.
>
>
> a) What is the best option: FreeBSD 9.1 or 8.4??
> b) Kernel options to monitor 1 GiB networks (ipc,buffers,etc)??
>
>
> Many thanks for your help in advance.
>
>
>
>
> Please, any tip??

I would use FreeBSD 9.1.  It has built in support for gpart (the default 
for the new installer) so it can handle disks larger than 2TB (which you 
will likely have) and has numerous improvements to the network stack as 
well as many of the network card drivers.

I can't answer the second question since I use the defaults, but there are 
pages on the internet describing how to turn the kernel for high speed 
network performance - like this one - 
<https://wiki.freebsd.org/NetworkPerformanceTuning>

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell