[Snort-users] PCAP_MEMORY issue
Stephen John Smoogen
smooge at ...11827...
Thu Feb 26 15:27:20 EST 2009
On Tue, Feb 24, 2009 at 1:49 PM, Jefferson, Shawn
<Shawn.Jefferson at ...14448...> wrote:
> I’m using PCAP_MEMORY, and the highest I can seem to go is:
> If I try to increase it, I get error messages when snort is starting:
> Error: setsockopt(PACKET_RX_RING): Cannot allocate memory
> However, running top shows I’ve got 1.8 GB of memory left available on this
> machine. Is there something else I need to tweak to allow a higher amount
> of memory for libpcap?
> PS. I’m using Phil Wood’s libpcap.
What is the system stats? CPU, kernel version, total memory, and does
the system have slab, slub, or some other memory allocation in use? [I
don't know how to tell this myself.. my systems are old enough to only
have slab.. but the new kernels would have access to different memory
allocations.] My guess is that one of the following is occuring:
Not enough continguous memory.
Contiguous Memory is not in a directly mappable zone. (If you have a
4+GB machine and you are trying to do this on a 32 bit architecture)
Stephen J Smoogen. -- BSD/GNU/Linux
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"
More information about the Snort-users