[Snort-users] Stream4 and other stuff

Martin Roesch roesch at ...1935...
Fri Jun 29 14:11:03 EDT 2001


Yes, it's not a critical optimization but it definitely makes sense. 
I'll make the change in my next update.

     -Marty

Phil Wood wrote:
> 
> Looking at stream4 from a memory allocation and deallocation standpoint.
> 
> In SaveAlloc, the first thing that is done is a calloc, then a check
> for memory usage exceeded, then finally a check for the calloc failure.
> Would it be better to drop the calloc down to just before the failure
> check?
> 
> void *SafeAlloc(unsigned long size)
> {
>     void *tmp;
> 
> ***from here.
> 
>     stream4_memory_usage += size;
> 
>     /* if we use up all of our RAM, try to free up some stale sessions */
>     if(stream4_memory_usage > s4data.memcap)
>     {
>         struct timeval tv;
>         struct timezone tz;
> 
>         safe_alloc_faults++;
> 
>         gettimeofday(&tv, &tz);
> 
>         if(!PruneSessionCache((u_int32_t)tv.tv_sec, 0))
>         {
>             /* if we can't prune due to time, just nuke 5 random sessions */
>             PruneSessionCache(0, 5);
>         }
>     }
> 
> ***to here:    tmp = (void *) calloc(size, sizeof(char));
> 
>     if(tmp == NULL)
>     {
>         FatalError("Unable to allocate memory! (%lu bytes in use)\n",
>                     stream4_memory_usage);
>     }
> 
>     return tmp;
> }
> 
> --
> Phil Wood, cpw at ...440...

--
Martin Roesch
roesch at ...1935...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-users mailing list