[Snort-devel] v2 mem usage chages?
Daniel J. Roelker
droelker at ...402...
Tue Mar 18 10:09:33 EST 2003
On Tue, 2003-03-18 at 11:31, Rich Adamson wrote:
> > > Interesting... I turned those options off; now it consumes 65 meg
> > > after a restart! Seems rather odd.
> > That's the new detection engine.
> Sure seems like a hell of a jump! Is there any way to pair that down
> through memcap entries, etc?
Well, it's a hell of a lot faster now. :) Seriously though, the memory
that's being used in Snort 2.0 is in the detection engine. Make sure
that you are using the mwm search method in the snort.conf (on by
default), that should only consume about 25 - 35 MBs (not counting
If you don't like that, then you'll have to use snort 1.9.1. We may add
the option in the future for a low memory multi-pattern matcher, but
don't quote me on that.
More information about the Snort-devel