[Snort-users] Question About the Current CVS version of snort

Christopher Cramer cec at ...68...
Sun Nov 5 11:02:58 EST 2000


Are you using the TCP reassembly plugin?  I have confirmed that it (most
likely) does not have a memory leak, but it does consume large amounts of
memory depending on the number of machines/ports being reassembled.

For me, it usually levels off at some point.

-Chris

----------------------------------------------------------------------
Dr. Christopher E. Cramer
Assistant Research Professor
Duke University, Department of Electrical and Computer Engineering
114 Hudson Hall, Box 90291, Durham, NC  27708-0291
PH:  919-660-5248     FAX:  919-660-5293     email:  cec at ...68...


On Sun, 5 Nov 2000, Len Burns wrote:

> Hi,
> 
> I have been using snort for some time here, and recentlhy began
> experimenting with acid for a console and analysis.  For that reason,
> and curiosity, I checked out a snort source tree.  I am building under
> NetBSD, 1.4.2, and 1.5 beta.  It builds normally under both.  It seems
> to work well under both as well, with one concern.  Over time, several
> hours, it seems to be gradually consuming a great deal of memory.  I
> saw it as high as 100 megs earlier on one host before I closed it
> down.  I am not sure if this is normal, or if I am seeing a leak.  If
> this would better be sent to the developement list, my apologies.
> 
> -Len
> 
> --
> Len Burns,
> Site Engineer for Sasquatch Computer
> lenb at ...750...
> Voice: 831-420-1053
> Fax: 831-420-0468
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users
> 




More information about the Snort-users mailing list