[Snort-devel] Stream4 woes ??

Chris Green cmg at ...402...
Tue Mar 11 05:26:30 EST 2003


"Lawrence Reed" <Lawrence.Reed at ...1489...> writes:

> Russell,
> Packet loss can probably cause this.  Are you dropping any packets?

Just to clarify what he's refering to is snort having "holes" in the
sequence numbers where it's has a dirty buffer that is used for
holding the stream packet data.

To test this, try seeing if adding a

bzero(stream_pkt->pkt, 2048); to line 3584 of spp_stream4.c and
running snort again.  If they all go away, it's packet loss. Try a
smaller ruleset, increasing your memcaps, or CVS HEAD.

-- 
Chris Green <cmg at ...402...>
A watched process never cores.





More information about the Snort-devel mailing list