[Snort-devel] [Resend] pb 100% cpu with stream4 in snort 1.9.0build209...build230

Erek Adams erek at ...835...
Sat Mar 8 11:36:02 EST 2003


On Thu, 6 Mar 2003, rmkml wrote:

> ok thanks for your answers,
> but it is possible you optimize ligne 670 ?
> because if memcap is fill, snort use 100% cpu
> during many seconds and drop pcap more packets (30% !)...

No, you can't optimize it.  It's crucial to the correct operation of
stream4.

You should either increase your memory pool or disable stream4.

How much sustained traffic are you seeing?  What kind of hardware?  How
much RAM and CPU on the box?

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-devel mailing list