Re: Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff)

[Dragos Ruiu <dr () kyx net>]

The other option is to define DEBUG... but if you've got tham much
fragmemuse...hmmm... that mugh debug output could be painful.
Though if it hits that fast with the debug on (i.e. not much output before
it get to that high number...  that tells one that it's an algorithm silly on
my part....

I'm looking, likely culprit, I prolly did something silly....

cheers,
--dr


On Mon, 02 Jul 2001, Martin Roesch wrote: > Philip Mayers
wrote: > > 
> > Wow - what service! Has anyone ever told you you're a very helpful guy?
>
> Well, I do what I can. :)
>
> > (gdb) p fragmemuse
> > $2 = 42387068
>
> Hmm, that number doesn't look insane, it's just kind of suprising that
> you'd be using that much RAM to store the packets that quickly.   Is
> there a lot of fragmented traffic on your network for some reason?
>
>      -Marty
>
> > Regards,
> > Phil
> >
> > +----------------------------------+
> > | Phil Mayers, Network Support     |
> > | Centre for Computing Services    |
> > | Imperial College                 |
> > +----------------------------------+
> >
> > ----- Original Message -----
> > From: "Martin Roesch" <roesch () sourcefire com>
> > To: "Mayers, Philip J" <p.mayers () ic ac uk>
> > Cc: "snort-users" <snort-users () lists sourceforge net>; "snort-dev"
> > <snort-devel () lists sourceforge net>
> > Sent: Monday, July 02, 2001 3:06 PM
> > Subject: Re: [Snort-devel] Defrag preprocessor crashing (was RE:
> > [Snort-users] Stream4 and other stuff)
> >
> > > Could you print out fragmemuse ('p fragmemuse' in gdb) and let me know
> > > what it looks like?
>
> --
> Martin Roesch
> roesch () sourcefire com
> http://www.sourcefire.com - http://www.snort.org
>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> http://lists.sourceforge.net/lists/listinfo/snort-devel
-- 
Dragos Ruiu <dr () dursec com>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net or at http://dursec.com/drkey.asc

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users