[Snort-users] Snort v2.1.1 Snort v2.1.3 Snort v2.2.0 Memory Leakage?

zacktoh zacktoh at ...12080...
Wed Jul 21 23:43:01 EDT 2004


Dear All,

I installed Snort v2.1.3 and ran it with the command "snort -A none -dev -l
log -h 192.168.0.0/24 -c etc/snort.conf" the problem of memory leakage still
exist. The rate of leakage was much slower than that of v2.1.1 but it still
goes at the rate of 16k/min. I let it run over the weekend and when I came
back, it had killed itself. By the way, I had 4 concurrent hping running all
the while simulating an attack packet.

I tried also to install Snort v2.2.0 but the memory leakage sky rocketed
with the 4 concurrent hping running and within one minute, it had killed
itself.

Hping commands:
1. hping2 -SF 192.168.0.21 -a 192.168.0.29
2. hping2 -2SF 192.168.0.21 -a 192.168.0.29
3. hping2 -SFU 192.168.0.21 -a 192.168.0.29
4. hping2 -2SFU 192.168.0.21 -a 192.168.0.29

Please advice.


Cheers,
Zack Toh


-----Original Message-----
From: sekure [mailto:sekure at ...11827...] 
Sent: Friday, July 16, 2004 9:32 PM
To: zacktoh
Cc: snort-users at lists.sourceforge.net; bmc at ...950...; jh at ...950...;
Masatsune Wake; Nishida; Takenaga
Subject: Re: [Snort-users] Snort v2.1.1 Memory Leakage?

This isn't normal behavior.  Why don't you upgrade to the newest
version and see if you still have the issue?  2.1.3 is the latest
stable releases and there is 2.2.0-RC1 if you want to live on the
edge.


----- Original Message -----
From: zacktoh <zacktoh at ...12080...>
Date: Fri, 16 Jul 2004 15:29:08 +0900
Subject: [Snort-users] Snort v2.1.1 Memory Leakage?
To: snort-users at lists.sourceforge.net, bmc at ...950..., jh at ...950...
Cc: Masatsune Wake <wake at ...12082...>, Nishida
<nishida.maiko at ...1141...>, Takenaga
<takenaga at ...12083...>




Dear All,

 

I would like to enquire if any of your have tried running snort and
monitoring system resources at the same time.

I installed a snort v2.1.1 on my FreeBSD 4.9 system and found that it
eats up about 48-81 K of my memory every minute. This had resulted in
very high memory consumption by snort and eventually killing itself
overtime.

 

I would like to know if this is a normal symptom of snort or is it
that there is some memory leakage from within snort?

 

Please advice.

 

Cheers,

Zack Toh.





More information about the Snort-users mailing list