[Snort-users] Memory usage on Snort

Andrew R. Baker andrewb0x29a at ...131...
Fri Sep 7 10:08:02 EDT 2001


Easy solution, don't use stream2, use stream4 instead.  stream2 is known
to have problems and all development on it has stopped.  Maybe i can
convince Marty to let me remove it from the current codebase.

-A


--- Scott Nursten <scott.nursten at ...2638...> wrote:
> Hey guys, 
> 
> Don't know if this has been mentioned before, but using 
> 
> preprocessor stream2: timeout 10, ports 25 80, maxbytes 16384
> 
> makes snort run away with 1.4GB of memory in under 12 hours on our net'.
> Once this is disabled, snort has not used more then 5.2MB of mem in 24
> hours. 
> 
> Any fixes - BTW I searched the archives for any stream2 complaints -
> there were a few complaints about memory usage, but no fixes. 
> 
>
http://www.geocrawler.com/search/?config=4890&words=stream2&SUBMIT=Search+snort-users
> 
> Rgds,
> 
> Scott 
> -- 
> 
> Scott Nursten - Systems Administrator
> ----------------------------------------------
> ddi:   +44 (0) 1293 744 122
> work:  +44 (0) 1293 402 040
> fax:   +44 (0) 1293 402 050
> email: scottn at ...2637...
> wwweb: http://www.streetsonline.co.uk
> ----------------------------------------------
> 
> 		Any sufficiently advanced technology is indistinguishable from magic.
> 					Arthur C. Clarke
> 
> 		Any technology distinguishable from magic is insufficiently advanced.
> 			 (Probably not) Arthur C. Clarke
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


__________________________________________________
Do You Yahoo!?
Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger
http://im.yahoo.com




More information about the Snort-users mailing list