[Snort-users] S5: Session exceeded configured max bytes

Jason Haar Jason.Haar at ...294...
Sun Dec 13 22:36:56 EST 2009

On 12/14/2009 11:25 AM, Joel Esler wrote:
> If this isn't happening very much, it might be just a "burst"/"freak
> occurrence".  If this happens a lot, I would up the max_queued_bytes
> in Stream5.  If you start dropping packets, you need more RAM.  (Or if
> you are dropping packets now).

I've added a zero on the end but unfortunately now I'm seeing

S5: Session exceeded configured max segs to queue 2621 using 2621 segs

Mainly web downloads by the looks of it - should I increase
max_queued_segs too? Would x2 (ie 5242) be about right?



Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

More information about the Snort-users mailing list