[Snort-devel] Snort 1.8.1-RELEASE silently exiting when stream4 enabled

Martin Roesch roesch at ...402...
Fri Aug 17 22:32:17 EDT 2001


Stream4 has been tested extensively and shown to be extremely stable on
tested platforms at heavy utilization rates (including tru64/Alpha), but
I haven't had a chance to test it on Alpha/Linux.  We do our best on
these less widespread platforms, but it's hard to debug for every
possible combination of hardware and software that are out there.


     -Marty


"Carl C." wrote:
> 
> ----- Original Message -----
> > From: <andrew.s.pendray at ...611...>
> > Date: Fri, 17 Aug 2001 16:37:46 -0400
> > To: snort-devel at lists.sourceforge.net
> > Subject: [Snort-devel] Snort 1.8.1-RELEASE silently exiting when stream4 enabled
> >
> > Everyone,
> >
> > I am running Snort 1.8.1-RELEASE (Build74) on a RedHat 7.1 system,
> > 2.4.3-12smp kernel, libpcap 0.6.2.  When I enable the stream4
> > pre-processor, Snort silently exits after ~ 15 minutes to several hours.  I
> >
> > If I comment out these lines in snort.conf, it will run forever:
> >
> >      #preprocessor stream4: detect_scans
> >      #preprocessor stream4_reassemble
> >
> > Andrew Pendray
> 
> I posted something earlier dealing with my Alpha Linux box doing the same
> thing. Mathieu Nantel wrote me to say that if you kill stream4 and use stream2,
> you should be fine. I guess stream4 is still in beta overtime.
> 
> Carl
> http://www.carlc.com/
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...402...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-devel mailing list