[Snort-devel] Snort: Unable to allocate memory.

Martin Roesch roesch at ...402...
Wed Nov 7 06:37:12 EST 2001


Did you add a 'memcap' argument to your stream4 preprocessor directive
in the snort.conf?  How are the stream4 and stream4_reassemble plugins
configured?

     -Marty

Jason Williams wrote:
> 
> This was the daily cvs build from November 5th.   The same problems were
> experienced with 1.8.2 build 86 and 1.8.1-RELEASE.
> 
> Redhat 6.2, Linux 2.2.14-6.0, on an Alpha.
> Using all the rules that came with the default snort.conf.
> Tried snort -Afull, snort -Afast
> Error Messages:
> 
> Pattern match failed
>    => Checking Option Node 859
> CheckIpOptions:   => Checking Option Node 860
> CheckIpOptions:   => Checking Option Node 861
> CheckIpOptions:   => Checking Option Node 876
>            <!!> CheckFragBits: [rule: 0x20:0   pkt: 0x40] Normal test
> failed
> No match, continuing...
> [*] Evaluating rule list: pass
> [*] Evaluating rule list: log
> Packet!
> caplen: 4294967295    pktlen: 4294967295
> 0   8
> IP datagram size calculated to be 4294967281 bytes
> ip header starts at: 0x120819f40, length is 4294967281
> IP Checksum: OK
> IP header length: 20
> TCP th_off is 5, passed len is 26
> TCP Checksum: OK
> tcp header starts at: 0x120819f54
> Unable to allocate memory! (2719 bytes in use)
> Fatal Error, Quitting..
> 
> The memory amount is not constant.  When not in debug mode, the error is:
> FATAL ERROR: Unable to allocate memory! (1887 bytes in use)
> 
> I believe it is part of stream4, which is why I tried the daily cvs
> snapshot after I read about there being some problems with unset
> variables.
> 
> This was built with  ./configure
> --with-libpcap-includes=/usr/local/src/libpcap-0.6.2 --enable-debug
> 
> The only change made to snort.conf was var HOME_NET.
> 
> I also ran a copy without --enable-debug, and with libpcap-0.4, to the
> same end.  I have had snort run on this machine before, but it was several
> versions ago.
> 
> --
> Jason Williams
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...402... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org




More information about the Snort-devel mailing list