[Snort-users] Memory leak

Martin Roesch roesch at ...1935...
Thu May 3 11:46:33 EDT 2001


Turn off SPADE and see if it continues...

   -Marty

Sid wrote:
> 
> ----snort.conf-------
> var INTERNAL [x.x.x.x/24,y.y.y.y/16]
> var EXTERNAL any
> var SMTP $INTERNAL
> var HTTP_SERVERS $INTERNAL
> var DNS_SERVERS [a.a.a.a/32,b.b.b.b/32]
> 
> preprocessor minfrag: 256
> preprocessor defrag
> preprocessor stream: timeout 10, ports 21 23 80, maxbytes 16384
> preprocessor http_decode: 80
> preprocessor portscan: $INTERNAL 4 3 portscan.log
> preprocessor portscan-ignorehosts: $DNS_SERVERS
> 
> var SPADEDIR /usr/local/snort/spade
> preprocessor spade: 10.5 $SPADEDIR/spade.rcv $SPADEDIR/log.txt 3 50000
> preprocessor spade-homenet: 202.87.0.0/16
> preprocessor spade-threshlearn: 200 24
> preprocessor spade-survey:  $SPADEDIR/survey.txt 60
> preprocessor spade-stats: entropy uncondprob condprob
> 
> output database: alert, mysql, user=root password=xxxx dbname=snort
> host=localhost
> output alert_full: alert
> -------------------------------------------------------------
> 
> cmdline switches :-
> -----------------------
> /usr/local/snort/bin/snort -D -d -C -i hme1 -c
> /usr/local/snort/conf/snort.conf -l /usr/local/snort/log/snort
> -----------------------
> 
> Siddhartha
> 
> ----- Original Message -----
> From: "Fyodor" <fygrave at ...121...>
> To: "Sid" <s_i_d_j at ...131...>
> Cc: "Martin Roesch" <roesch at ...1935...>; <william.c.gercken at ...1971...>;
> "Erek Adams" <erek at ...577...>; <snort-users at lists.sourceforge.net>;
> <snort-users-admin at lists.sourceforge.net>
> Sent: Thursday, May 03, 2001 9:05 PM
> Subject: Re: [Snort-users] Memory leak
> 
> > On Thu, May 03, 2001 at 08:43:32PM +0530, Sid wrote:
> > > No guys!!! This is Snort 1.7. On Solaris 2.6/UltraSparc-II (Dual, 1 GB
> RAM).
> > >
> >
> > can we see your snort.conf and cmdline switches if possible? :)
> 
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com

--
Martin Roesch
roesch at ...1935...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-users mailing list