[Snort-users] 2.6.1 and LOOOONG startup times plusmoreignore_scanners info
YorkJ at ...7109...
Fri Nov 17 12:01:29 EST 2006
> -----Original Message-----
> From: James Lay [mailto:jlay at ...13475...]
> Sent: Friday, November 17, 2006 11:17 AM
> To: 'Snort'
> Subject: Re: [Snort-users] 2.6.1 and LOOOONG startup times
> plusmoreignore_scanners info
> And HOLY SMACKERS! Ac-bnfa sure made a difference! Tested
> with that and
> now snort is using 9% of memory, and init time was less then a minute!
HOLY SMACKERS indeed! I was having similar problems--thought my snort
had gone into an infinite loop since it took so long to start. ac-bnfa
made no sense to me, so I RTFM. No help there, so in desparation I
RTFRL. There I found this:
* Smaller memory footprint pattern mattcher using Aho-Corasick,
using NFA. Use 'config detection: search-method ac-bnfa' to
enable. This will become the default pattern matcher in future
releases. Wu-Manhber has been deprecated (mwm).
Now life is good again (more or less.)
More information about the Snort-users