[Snort-users] Snort with low mem

Todd Wease twease at ...1935...
Fri Jun 11 04:24:04 EDT 2010


Hi Parag,

Depending on the ruleset, ac-bnfa may use less memory than lowmem.  
Snort 2.8.6 adds a new option "split-any-any" that can drastically 
reduce memory depending on the amount of any-any port rules.  I'd give 
that a try to see if it helps.

Todd

On 06/09/2010 08:06 AM, Parag Pote wrote:
> Anybody has any idea from devel team? I am using 2.8.5 and lowmem doesn't seem to be working for me. Taking same memory as without it.
>
> Any help is greatly appreciated.
>
> Parag
>
> --- On Thu, 5/20/10, Joel Esler<jesler at ...1935...>  wrote:
>
>    
>> From: Joel Esler<jesler at ...1935...>
>> Subject: Re: [Snort-users] Snort with low mem
>> To: "Parag Pote"<pipsparag at ...131...>
>> Cc: snort-users at lists.sourceforge.net
>> Date: Thursday, May 20, 2010, 9:35 AM
>> I don't *think* anything has changed
>> in the lowmem search method in recent releases, maybe
>> someone from devel can comment on it, however, in 2.8.6, we
>> have a new bnfa search method which is faster and uses less
>> memory than before.  Might want to check that one out.
>>
>>
>> On May 20, 2010, at 8:17 AM, Parag Pote wrote:
>>
>>      
>>> Hi,
>>>
>>> I am using snort 2.8.5. I tried running snort with and
>>>        
>> without
>>      
>>> config detection: serach-method lowmem
>>>
>>> But with both the memory required is same. I remember
>>>        
>> in earlier version(long back 2.3.0) I used to see less
>> memory requirement with lowmem algorithm. Is something
>> changed in recent releases?
>>      
>>> Rgds,
>>> Parag
>>>
>>>
>>>
>>>
>>>
>>>
>>>        
>> ------------------------------------------------------------------------------
>>      
>>> _______________________________________________
>>> Snort-users mailing list
>>> Snort-users at lists.sourceforge.net
>>> Go to this URL to change user options or unsubscribe:
>>> https://lists.sourceforge.net/lists/listinfo/snort-users
>>> Snort-users list archive:
>>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>>        
>> --
>> Joel Esler
>>
>>
>>
>>
>>
>>
>>
>>
>>      
>
>
>
>
> ------------------------------------------------------------------------------
> ThinkGeek and WIRED's GeekDad team up for the Ultimate
> GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
> lucky parental unit.  See the prize list and enter to win:
> http://p.sf.net/sfu/thinkgeek-promo
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>    





More information about the Snort-users mailing list