[Snort-users] Stream5 error

Al Lewis (allewi) allewi at ...589...
Thu Apr 7 15:02:49 EDT 2016

Do you have a copy of your configuration that you can share?

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...

From: Dave Corsello [mailto:snort-users at ...15598...]
Sent: Thursday, April 07, 2016 2:08 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Stream5 error

I'm getting a number of S5 errors like the following:
Session exceeded configured max bytes to queue 1048576 using 1050000 bytes (client queue). xx.xx.xx.xx 13624 --> xx.xx.xx.xx 80 (0) : LWstate 0x9 LWFlags 0x6007

I typically have not seen this error.  I'm not sure when it started.  I'm concerned because in each case, the source and destination IPs are identical to one another, and because in each case the address is a public address outside of my network.  Can someone help me to understand what's happening, and if correctable, what kinds of Snort configuration changes can correct this?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20160407/06d79e9d/attachment.html>

More information about the Snort-users mailing list