[Snort-devel] Snort: Unable to allocate memory.
roesch at ...402...
Wed Nov 7 06:37:12 EST 2001
Did you add a 'memcap' argument to your stream4 preprocessor directive
in the snort.conf? How are the stream4 and stream4_reassemble plugins
Jason Williams wrote:
> This was the daily cvs build from November 5th. The same problems were
> experienced with 1.8.2 build 86 and 1.8.1-RELEASE.
> Redhat 6.2, Linux 2.2.14-6.0, on an Alpha.
> Using all the rules that came with the default snort.conf.
> Tried snort -Afull, snort -Afast
> Error Messages:
> Pattern match failed
> => Checking Option Node 859
> CheckIpOptions: => Checking Option Node 860
> CheckIpOptions: => Checking Option Node 861
> CheckIpOptions: => Checking Option Node 876
> <!!> CheckFragBits: [rule: 0x20:0 pkt: 0x40] Normal test
> No match, continuing...
> [*] Evaluating rule list: pass
> [*] Evaluating rule list: log
> caplen: 4294967295 pktlen: 4294967295
> 0 8
> IP datagram size calculated to be 4294967281 bytes
> ip header starts at: 0x120819f40, length is 4294967281
> IP Checksum: OK
> IP header length: 20
> TCP th_off is 5, passed len is 26
> TCP Checksum: OK
> tcp header starts at: 0x120819f54
> Unable to allocate memory! (2719 bytes in use)
> Fatal Error, Quitting..
> The memory amount is not constant. When not in debug mode, the error is:
> FATAL ERROR: Unable to allocate memory! (1887 bytes in use)
> I believe it is part of stream4, which is why I tried the daily cvs
> snapshot after I read about there being some problems with unset
> This was built with ./configure
> --with-libpcap-includes=/usr/local/src/libpcap-0.6.2 --enable-debug
> The only change made to snort.conf was var HOME_NET.
> I also ran a copy without --enable-debug, and with libpcap-0.4, to the
> same end. I have had snort run on this machine before, but it was several
> versions ago.
> Jason Williams
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...402... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org
More information about the Snort-devel