[Snort-users] Snort slurps memory

Erek Adams erek at ...950...
Fri Jan 31 06:12:05 EST 2003


On Fri, 31 Jan 2003, Maarten de Vries wrote:

> If this has been discussed before I apologize, but I haven't found an answer
> in the archives so far.

It's there...  I know, I've answered it before.  ;-)

> Ever since we upgraded to 1.9.0, the amount of memory Snort uses has
> increased dramatically. The total size of the process was never more than
> about 8Mb, however, Snort now seems to occupy around 50Mb.
> Can anyone tell me why the process has grown so incredibly large?

Yep.  Sure can.  spp_conversation and spp_stream4.  They both grab large
chunks of memory to handle all of the stateful detection and flow
information.  Check the FAQ [0] for a question regarding how to configure
it.

To be honest, I wouldn't worry about it.  You've got enough memory for
that ~50MB not to be a problem unless you're on a heavily used (bunch
of other apps) box.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]	http://www.snort.org/docs/faq.html#3.14




More information about the Snort-users mailing list