[Snort-users] Question About the Current CVS version of snort

Christopher Cramer cec at ...68...
Sun Nov 5 11:02:58 EST 2000

Are you using the TCP reassembly plugin?  I have confirmed that it (most
likely) does not have a memory leak, but it does consume large amounts of
memory depending on the number of machines/ports being reassembled.

For me, it usually levels off at some point.


Dr. Christopher E. Cramer
Assistant Research Professor
Duke University, Department of Electrical and Computer Engineering
114 Hudson Hall, Box 90291, Durham, NC  27708-0291
PH:  919-660-5248     FAX:  919-660-5293     email:  cec at ...68...

On Sun, 5 Nov 2000, Len Burns wrote:

> Hi,
> I have been using snort for some time here, and recentlhy began
> experimenting with acid for a console and analysis.  For that reason,
> and curiosity, I checked out a snort source tree.  I am building under
> NetBSD, 1.4.2, and 1.5 beta.  It builds normally under both.  It seems
> to work well under both as well, with one concern.  Over time, several
> hours, it seems to be gradually consuming a great deal of memory.  I
> saw it as high as 100 megs earlier on one host before I closed it
> down.  I am not sure if this is normal, or if I am seeing a leak.  If
> this would better be sent to the developement list, my apologies.
> -Len
> --
> Len Burns,
> Site Engineer for Sasquatch Computer
> lenb at ...750...
> Voice: 831-420-1053
> Fax: 831-420-0468
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users

More information about the Snort-users mailing list