[Snort-users] PCAP_MEMORY issue

Stephen John Smoogen smooge at ...11827...
Thu Feb 26 15:27:20 EST 2009

On Tue, Feb 24, 2009 at 1:49 PM, Jefferson, Shawn
<Shawn.Jefferson at ...14448...> wrote:
> I’m using PCAP_MEMORY, and the highest I can seem to go is:
> PCAP_MEMORY=800000
> If I try to increase it, I get error messages when snort is starting:
> Error: setsockopt(PACKET_RX_RING): Cannot allocate memory
> However, running top shows I’ve got 1.8 GB of memory left available on this
> machine.  Is there something else I need to tweak to allow a higher amount
> of memory for libpcap?
> PS. I’m using Phil Wood’s libpcap.

What is the system stats? CPU, kernel version, total memory, and does
the system have slab, slub, or some other memory allocation in use? [I
don't know how to tell this myself.. my systems are old enough to only
have slab.. but the new kernels would have access to different memory
allocations.] My guess is that one of the following is occuring:

Not enough continguous memory.
Contiguous Memory is not in a directly mappable zone. (If you have a
4+GB machine and you are trying to do this on a 32 bit architecture)

Stephen J Smoogen. -- BSD/GNU/Linux
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"

More information about the Snort-users mailing list