[Snort-devel] Snort: Unable to allocate memory.

Jason Williams jwilliam at ...921...
Tue Nov 6 00:24:07 EST 2001

This was the daily cvs build from November 5th.   The same problems were
experienced with 1.8.2 build 86 and 1.8.1-RELEASE.

Redhat 6.2, Linux 2.2.14-6.0, on an Alpha.
Using all the rules that came with the default snort.conf.
Tried snort -Afull, snort -Afast
Error Messages:

Pattern match failed
   => Checking Option Node 859
CheckIpOptions:   => Checking Option Node 860
CheckIpOptions:   => Checking Option Node 861
CheckIpOptions:   => Checking Option Node 876
           <!!> CheckFragBits: [rule: 0x20:0   pkt: 0x40] Normal test
No match, continuing...
[*] Evaluating rule list: pass
[*] Evaluating rule list: log
caplen: 4294967295    pktlen: 4294967295
0   8
IP datagram size calculated to be 4294967281 bytes
ip header starts at: 0x120819f40, length is 4294967281
IP Checksum: OK
IP header length: 20
TCP th_off is 5, passed len is 26
TCP Checksum: OK
tcp header starts at: 0x120819f54
Unable to allocate memory! (2719 bytes in use)
Fatal Error, Quitting..

The memory amount is not constant.  When not in debug mode, the error is:
FATAL ERROR: Unable to allocate memory! (1887 bytes in use) 

I believe it is part of stream4, which is why I tried the daily cvs
snapshot after I read about there being some problems with unset

This was built with  ./configure
--with-libpcap-includes=/usr/local/src/libpcap-0.6.2 --enable-debug

The only change made to snort.conf was var HOME_NET.

I also ran a copy without --enable-debug, and with libpcap-0.4, to the
same end.  I have had snort run on this machine before, but it was several
versions ago.

Jason Williams

More information about the Snort-devel mailing list