[Snort-devel] Possible Memory Leak?

Martin Roesch roesch at ...48...
Tue Apr 17 13:30:47 EDT 2001


Well, I'd suspect the stream reassembler since Chris coded up a new
memory manager for it recently and the defrag code hasn't really changed
much.  Chris?

    -Marty

Len Burns wrote:
> 
> On Tue, 17 Apr 2001, Martin Roesch wrote:
> 
> > As the tcp stream reassembler and IP defragmenter start analyzing
> > traffic they start to eat memory to keep state and store packets.  It
> > should steady down after a while to a pretty static size, see how long
> > it takes to get to a value like 14MB and see if remains relatively
> > steady there....
> I have had a snort session running since Saturday evening, the good
> news is, it has not crashed, but I do think we have a leak.  From top:
> 2183 root       4    0   111M   62M sleep   119:48  3.81%  3.81% snort
> It has been steadily growing.  I have let it run, because it is on a
> test box where it can do no harm.
> 
> -Len
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...48...
http://www.snort.org




More information about the Snort-devel mailing list