[Snort-devel] Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff)

Dragos Ruiu dr at ...40...
Mon Jul 2 11:31:20 EDT 2001


The other option is to define DEBUG... but if you've got tham much
fragmemuse...hmmm... that mugh debug output could be painful.
Though if it hits that fast with the debug on (i.e. not much output before
it get to that high number...  that tells one that it's an algorithm silly on
my part....

I'm looking, likely culprit, I prolly did something silly....

cheers,
--dr


On Mon, 02 Jul 2001, Martin Roesch wrote: > Philip Mayers
wrote: > > 
> > Wow - what service! Has anyone ever told you you're a very helpful guy?
> 
> Well, I do what I can. :)
> 
> > (gdb) p fragmemuse
> > $2 = 42387068
> 
> Hmm, that number doesn't look insane, it's just kind of suprising that
> you'd be using that much RAM to store the packets that quickly.   Is
> there a lot of fragmented traffic on your network for some reason?
> 
>      -Marty
> 
> > 
> > Regards,
> > Phil
> > 
> > +----------------------------------+
> > | Phil Mayers, Network Support     |
> > | Centre for Computing Services    |
> > | Imperial College                 |
> > +----------------------------------+
> > 
> > ----- Original Message -----
> > From: "Martin Roesch" <roesch at ...402...>
> > To: "Mayers, Philip J" <p.mayers at ...489...>
> > Cc: "snort-users" <snort-users at lists.sourceforge.net>; "snort-dev"
> > <snort-devel at lists.sourceforge.net>
> > Sent: Monday, July 02, 2001 3:06 PM
> > Subject: Re: [Snort-devel] Defrag preprocessor crashing (was RE:
> > [Snort-users] Stream4 and other stuff)
> > 
> > >
> > > Could you print out fragmemuse ('p fragmemuse' in gdb) and let me know
> > > what it looks like?
> > >
> 
> --
> Martin Roesch
> roesch at ...402...
> http://www.sourcefire.com - http://www.snort.org
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel
-- 
Dragos Ruiu <dr at ...9...>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net or at http://dursec.com/drkey.asc




More information about the Snort-devel mailing list