[Snort-users] what is the difference in memory models (search-method lowmem) mean?

Jason Haar Jason.Haar at ...294...
Sun Sep 17 23:11:37 EDT 2006

I have been putting off upgrading our snort network from 2.4X to 2.6 for
ages because we run a fairly full ruleset and I saw memory usage leap
between the two versions.

e.g. I just tried out and our snort installs hit 850MB RAM per
process - owch! (under RHE4). This compares with 240MB under 2.4X

However, if I enable the line "config detection: search-method lowmem",
memory utilization under 2.6 falls waaaaay down to <100MB.

Sounds too good to be true. What am I missing out on by doing such an
action? And if this sort of memory usage is expected, is everyone just
putting in 4G RAM to deal with this sort of thing?



Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

More information about the Snort-users mailing list