[Snort-devel] Stream4 woes ??
cmg at ...402...
Tue Mar 11 05:26:30 EST 2003
"Lawrence Reed" <Lawrence.Reed at ...1489...> writes:
> Packet loss can probably cause this. Are you dropping any packets?
Just to clarify what he's refering to is snort having "holes" in the
sequence numbers where it's has a dirty buffer that is used for
holding the stream packet data.
To test this, try seeing if adding a
bzero(stream_pkt->pkt, 2048); to line 3584 of spp_stream4.c and
running snort again. If they all go away, it's packet loss. Try a
smaller ruleset, increasing your memcaps, or CVS HEAD.
Chris Green <cmg at ...402...>
A watched process never cores.
More information about the Snort-devel