Author Archives: Mike Lococo

Capacity Planning for Snort IDS

Posted on 8/14/2011 by Mike Lococo

Snort is a very capable network intrusion detection system, but planning a first-time hardware purchase can be difficult. It requires fairly deep knowledge of x86 server performance, network usage patterns at your site, along with some snort-specific knowledge. Documentation is … Continue reading →

Posted in geekery | 6 Comments

Monitoring Snort Performance with Zabbix

Posted on 4/12/2011 by Mike Lococo

In January I gave a presentation to the REN-ISAC on how to monitor the performance of Snort IDS systems. It covers: A comparison of high-performance capture-frameworks like vanilla-libpcap vs pfring vs dedicated capture cards from Endace or similar. An overview … Continue reading →

Posted in geekery | 2 Comments

Relaunch

Posted on 10/19/2010 by Mike Lococo

My RSS subscriber has reminded me that my feeds have gone a little bit wild over the last couple of days as I’ve gone through old posts to retag and update dead links. That’s all finished now, promise. I’ve been … Continue reading →

Posted in geekery | Tagged , , | 1 Comment

Virtualization and Security Boundaries

Posted on 6/7/2009 by Mike Lococo

Virtualization security is coming up frequently in higher-ed security forums as folks scramble to understand best-practices before whatever path-of-least-resistance gets too entrenched to change.  Unfortunately, there’s almost no intermediate-level documents on virtualization security to help us wrap our heads around … Continue reading →

Posted in geekery, personal | Tagged , | Leave a comment

Fedora 8 on a Dell Latitude D620

Posted on 3/23/2008 by Mike Lococo

Fedora 8 works quite well on the D620 right out of the box, and with a few tweaks can be just about fully supported. This guide summarizes what I’ve done to get things working to my satisfaction. It is not … Continue reading →

Posted in geekery | Tagged , , , , , | Leave a comment