[Snort-devel] v2 mem usage chages?

Daniel J. Roelker droelker at ...402...
Tue Mar 18 10:09:33 EST 2003


On Tue, 2003-03-18 at 11:31, Rich Adamson wrote:
> 
> > > Interesting... I turned those options off; now it consumes 65 meg
> > > after a restart! Seems rather odd.
> > 
> > That's the new detection engine.
> 
> Sure seems like a hell of a jump! Is there any way to pair that down
> through memcap entries, etc?
> 
> Rich

Well, it's a hell of a lot faster now.  :)  Seriously though, the memory
that's being used in Snort 2.0 is in the detection engine.  Make sure
that you are using the mwm search method in the snort.conf (on by
default), that should only consume about 25 - 35 MBs (not counting
stream4).

If you don't like that, then you'll have to use snort 1.9.1.  We may add
the option in the future for a low memory multi-pattern matcher, but
don't quote me on that.

Dan






More information about the Snort-devel mailing list