[Snort-devel] Possible Memory Leak?

Martin Roesch roesch at ...48...
Tue Apr 17 12:50:21 EDT 2001


As the tcp stream reassembler and IP defragmenter start analyzing
traffic they start to eat memory to keep state and store packets.  It
should steady down after a while to a pretty static size, see how long
it takes to get to a value like 14MB and see if remains relatively
steady there....

     -Marty

Erek Adams wrote:
> 
> Version 1.8-beta1 (Build 10) (cvs, updated 4/10/01 @ 6:00AM PDT)
> libpcap 0.6.2 (updated 3/4/01)
> 
> Plugins:
>   preprocessor defrag
>   preprocessor stream2: timeout 10, ports 21 23 80 110 143, maxbytes 16384
>   preprocessor http_decode: 80 -unicode -cginull
>   preprocessor rpc_decode: 111 32771
>   preprocessor bo: -nobrute
>   preprocessor telnet_decode
>   preprocessor portscan: $HOME_NET 4 2 portscan.log
>   preprocessor portscan-ignorehosts: $DNS_SERVERS
> 
> I've noticed that snort seems to be eating memory.  I started snort on 4/10,
> and all was normal....  On 4/13 I noticed that it's memory usage had grown to
> a whopping 12MB!  I wasn't sure if it was still growing or had reached a
> stable size.  As of today, it's up to 14MB.
> 
> So, I started a new copy just to see what it's memory size was:  6.4MB
> 
> I'll try to do some testing with the preprocessors and see if that makes a
> difference later tonight.
> 
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...48...
http://www.snort.org




More information about the Snort-devel mailing list