[Snort-users] Re: memory leak in Snort 1.8.7?

Matthew Harrell mhar at ...7038...
Thu Oct 3 12:03:05 EDT 2002

Nevermind--RTFM.  :)

Matt Harrell
Plexus Systems
mhar at ...7038...

-----  On 10/3/2002 1:01 PM, Matthew Harrell <mhar at ...7038...> wrote: 
>Here's my setup:
>I'm running Mandrake Linux 9.0 on a Pentium 200 with 64 MB RAM.  I'm
>running snort-1.8.7-3mdk.rpm.  A little while ago, I changed two things.  I
>upgraded from Mandrake Linux 9.0beta2 to 9.0, and I changed the switch port
>that this box is on so that it hears traffic on all of the ports on that
>switch.  Since then, obviously, I've seen greatly increased scans in Snort
>(about 1 to 2 unique IP numbers an hour, but it varies).
>Before these two things were changed, Snort ran just fine, not using up a
>significant amount of memory.  Now, Snort gradually consumes all spare RAM
>and VRAM (which is set at 256 MB).  It seems to take about 24 hours for it
>to use up all the swap space.  The system gets gradually slower and slower
>until it's just about unusable.
>Now, is this a memory leak, or is Snort just going to need a HUGE amount of
>RAM due to the increased traffic it sees?
>Matt Harrell
>Plexus Systems
>mhar at ...7038...

More information about the Snort-users mailing list