[Snort-users] 2.6.1 and LOOOONG startup times plusmoreignore_scanners info

John York YorkJ at ...7109...
Fri Nov 17 12:01:29 EST 2006


 
> -----Original Message-----
> From: James Lay [mailto:jlay at ...13475...] 
> Sent: Friday, November 17, 2006 11:17 AM
> To: 'Snort'
> Subject: Re: [Snort-users] 2.6.1 and LOOOONG startup times 
> plusmoreignore_scanners info
> 
> And HOLY SMACKERS!  Ac-bnfa sure made a difference!  Tested 
> with that and
> now snort is using 9% of memory, and init time was less then a minute!
> 
HOLY SMACKERS indeed!  I was having similar problems--thought my snort
had gone into an infinite loop since it took so long to start.  ac-bnfa
made no sense to me, so I RTFM.  No help there, so in desparation I
RTFRL.  There I found this:
    * Smaller memory footprint pattern mattcher using Aho-Corasick,
      using NFA.  Use 'config detection: search-method ac-bnfa' to 
      enable.  This will become the default pattern matcher in future
      releases.  Wu-Manhber has been deprecated (mwm).
Now life is good again (more or less.)
Thanks
John




More information about the Snort-users mailing list