[Snort-users] Snort slurps memory
erek at ...950...
Fri Jan 31 06:12:05 EST 2003
On Fri, 31 Jan 2003, Maarten de Vries wrote:
> If this has been discussed before I apologize, but I haven't found an answer
> in the archives so far.
It's there... I know, I've answered it before. ;-)
> Ever since we upgraded to 1.9.0, the amount of memory Snort uses has
> increased dramatically. The total size of the process was never more than
> about 8Mb, however, Snort now seems to occupy around 50Mb.
> Can anyone tell me why the process has grown so incredibly large?
Yep. Sure can. spp_conversation and spp_stream4. They both grab large
chunks of memory to handle all of the stateful detection and flow
information. Check the FAQ  for a question regarding how to configure
To be honest, I wouldn't worry about it. You've got enough memory for
that ~50MB not to be a problem unless you're on a heavily used (bunch
of other apps) box.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-users