[Snort-devel] [Resend] pb 100% cpu with stream4 in snort 1.9.0build209...build230

rmkml rmkml at ...1042...
Wed Mar 5 08:38:11 EST 2003


of course,
but if memcap is new fill,
same pb: 100%cpu ...
and why comment lines decrease cpu ?


Chris Green wrote:

> rmkml <rmkml at ...1042...> writes:
>
> > Hi,
> >
> > my conf stream4 is : (default conf)
> > preprocessor stream4: detect_scans, disable_evasion_alerts
> > preprocessor stream4_reassemble
> >
> > I start nmap (on other box) and scan (on other box) 65000 (example)
> > ports via tcp Syn...
> >
> > Snort detect scan, and stream4 start allocate memory (default stream4
> > memcap : 8 388 608),
> >
> > when 8M is not fill, snort use 20-60% cpu (and 100%cpu during 1s),
> >
> > when 8M is fill, snort use 100% cpu during 5s ! (and drop 30% pcap
> > packet, and Stream4
>
> Yup. When you fill up, we spend our time trying to free it up.  Use
> more memory.
> --
> Chris Green <cmg at ...402...>
> Chicken's thinkin'





More information about the Snort-devel mailing list