[Snort-devel] Possible Memory Leak?

Erek Adams erek at ...105...
Mon Apr 16 19:35:09 EDT 2001

Version 1.8-beta1 (Build 10) (cvs, updated 4/10/01 @ 6:00AM PDT)
libpcap 0.6.2 (updated 3/4/01)

  preprocessor defrag
  preprocessor stream2: timeout 10, ports 21 23 80 110 143, maxbytes 16384
  preprocessor http_decode: 80 -unicode -cginull
  preprocessor rpc_decode: 111 32771
  preprocessor bo: -nobrute
  preprocessor telnet_decode
  preprocessor portscan: $HOME_NET 4 2 portscan.log
  preprocessor portscan-ignorehosts: $DNS_SERVERS

I've noticed that snort seems to be eating memory.  I started snort on 4/10,
and all was normal....  On 4/13 I noticed that it's memory usage had grown to
a whopping 12MB!  I wasn't sure if it was still growing or had reached a
stable size.  As of today, it's up to 14MB.

So, I started a new copy just to see what it's memory size was:  6.4MB

I'll try to do some testing with the preprocessors and see if that makes a
difference later tonight.

Erek Adams

More information about the Snort-devel mailing list