[Snort-users] snort performance vs traffic

Erek Adams erek at ...577...
Tue Jul 9 09:04:04 EDT 2002


On Tue, 9 Jul 2002, Tim Prendergast wrote:

> Curious to see what you are running in comparison to my config, because
> my snort is running out of memory and dying every day during the busy
> hours.
>
> We're pushing like 4 T-1's worth of traffic coming in from the net, not
> to mention the traffic from our internal machines across the 100mb
> switch I am snorting. It's on a box with a 500mhz PIII and 256mb of
> memory. Am I way under-arming this machine for this task?

Tim, it sounds like you're getting bitten by an older bit of code.  IIRC, that
was an issue with an older version but has now been fixed.  If you're not
already, try the 1.8.7 release[0] and see if that helps.

If you're already running it, can you give us some more details on OS and
version, disk systems, etc.?

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list