[Snort-devel] [Resend] pb 100% cpu with stream4 in snort 1.9.0build209...build230
rmkml at ...1042...
Wed Mar 5 09:00:16 EST 2003
but if memcap is new fill,
same pb: 100%cpu ...
and why comment lines decrease cpu ?
Chris Green wrote:
> rmkml <rmkml at ...1042...> writes:
> > Hi,
> > my conf stream4 is : (default conf)
> > preprocessor stream4: detect_scans, disable_evasion_alerts
> > preprocessor stream4_reassemble
> > I start nmap (on other box) and scan (on other box) 65000 (example)
> > ports via tcp Syn...
> > Snort detect scan, and stream4 start allocate memory (default stream4
> > memcap : 8 388 608),
> > when 8M is not fill, snort use 20-60% cpu (and 100%cpu during 1s),
> > when 8M is fill, snort use 100% cpu during 5s ! (and drop 30% pcap
> > packet, and Stream4
> Yup. When you fill up, we spend our time trying to free it up. Use
> more memory.
> Chris Green <cmg at ...402...>
> Chicken's thinkin'
More information about the Snort-devel