[Snort-users] Stream5 Reassembly ports
wkitty42 at ...14940...
Tue May 27 13:47:52 EDT 2014
On 5/27/2014 5:15 AM, NIDS TEAM wrote:
> Hi again
> Does anybody know why I am getting this sort of log messages:
yep! read your config...
> snort: S5: Session exceeded configured max bytes to queue 2097152 using
> 2097254 bytes (client queue). 10.0.0.12 61326 --> 10.0.0.13 3299 (0) : LWstate
> 0x40 LWFlags 0x2102
> With the following Stream5 configuration:
> preprocessor stream5_global: track_tcp yes, \
> track_udp yes, \
> track_icmp no, \
> max_tcp 65536, \
> max_udp 65536, \
> memcap 536870912
> preprocessor stream5_tcp: policy windows, \
> timeout 60, \
> max_queued_bytes 2097152, \
cause: this value, max_queued_bytes, is the setting and the session tried to
load more than this value...
solution: increase this value...
NOTE: No off-list assistance is given without prior approval.
Please *keep mailing list traffic on the list* unless
private contact is specifically requested and granted.
More information about the Snort-users