[Snort-users] Snort use of memory

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Tue Nov 2 00:50:49 EST 2004


--On 01 November 2004 15:24 -0500 Matt Kettler <mkettler at ...4108...> wrote:

> At 10:16 AM 11/1/2004, Larry Wichman wrote:
>> I added more memory to one of my Snort boxes but Snort
>> does not seem to want to use it. I thought there was a
>> doc somewhere that says how to tell Snort to use more
>> memory. Can anyone point me to the doc. I looked
>> through the archives and FAQs and did not see
>> anything.
>
> Erm.. Why do you even want snort to consume more memory?
>
> Snort's not a cached and buffered system.

It can be, if you link it against Phil Woods' libpcap 
<http://public.lanl.gov/cpw/>, which improves performance of sniffing 
applications such as Snort, by allocating user-definable ring buffers.

Best Regards,
Alex.
-- 
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9






More information about the Snort-users mailing list