[Snort-devel] [Resend] pb 100% cpu with stream4 in snort 1.9.0 build209...build230

Chris Green cmg at ...402...
Wed Mar 5 08:35:05 EST 2003


rmkml <rmkml at ...1042...> writes:

> Hi,
>
> my conf stream4 is : (default conf)
> preprocessor stream4: detect_scans, disable_evasion_alerts
> preprocessor stream4_reassemble
>
> I start nmap (on other box) and scan (on other box) 65000 (example)
> ports via tcp Syn...
>
> Snort detect scan, and stream4 start allocate memory (default stream4
> memcap : 8 388 608),
>
> when 8M is not fill, snort use 20-60% cpu (and 100%cpu during 1s),
>
> when 8M is fill, snort use 100% cpu during 5s ! (and drop 30% pcap
> packet, and Stream4

Yup. When you fill up, we spend our time trying to free it up.  Use
more memory.
-- 
Chris Green <cmg at ...402...>
Chicken's thinkin'




More information about the Snort-devel mailing list