[Snort-users] PCAP_MEMORY issue

Jefferson, Shawn Shawn.Jefferson at ...14448...
Tue Feb 24 15:49:04 EST 2009


I'm using PCAP_MEMORY, and the highest I can seem to go is:
PCAP_MEMORY=800000

If I try to increase it, I get error messages when snort is starting:
Error: setsockopt(PACKET_RX_RING): Cannot allocate memory

However, running top shows I've got 1.8 GB of memory left available on this machine.  Is there something else I need to tweak to allow a higher amount of memory for libpcap?

PS. I'm using Phil Wood's libpcap.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090224/c079082a/attachment.html>


More information about the Snort-users mailing list