Snort mailing list archives
Re: Alert payloads not matching alert rules
From: Joel Esler <joel.esler () sourcefire com>
Date: Mon, 27 Nov 2006 09:13:12 -0500
No, I do not mean multiple instances of Snort overwriting each others memory. "its OWN memory". I am talking about a single Snort process. Then when you try and run 3 on the same box, you wind up trying to cram too much traffic in too small of a hole. Plus there is no way to know how the Snort process is tuned. Follow Marc's advice and use "zero_flushed_packets" within stream4. J On Thu, Nov 23, 2006 at 09:21:51AM +1300, it looks like Jason Haar sent me:
Joel Esler wrote:Are you dropping any packets? It seems that with 3 processes of Snort, on the same box, with only 2 Gigs of RAM trying to analyze that much traffic, you are probably dropping packets in addition to Snort overwriting its own memory.Hi Joel Can you explain what you mean by snort overwriting it's own memory? How is that possible? I thought standard OS process separation would stop that? (I am assuming you meant having >1 snort process leads to one snort process "corrupting" another) I also routinely run multiple snort instances - this comes as a bit of a shock... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
+---------------------------------------------------------------------+ joel esler senior security consultant 1-706-627-2101 Sourcefire Security for the /Real/ World -- http://www.sourcefire.com Snort - Open Source Network IPS/IDS -- http://www.snort.org gpg key: http://demo.sourcefire.com/jesler.pgp.key +---------------------------------------------------------------------+ ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Alert payloads not matching alert rules spagno_f (Nov 21)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 22)
- <Possible follow-ups>
- Re: Alert payloads not matching alert rules spagno_f (Nov 22)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 22)
- Re: Alert payloads not matching alert rules Jason Haar (Nov 22)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 27)
- Re: Alert payloads not matching alert rules Marc Norton (Nov 22)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 22)
- Re: Alert payloads not matching alert rules spagno_f (Nov 23)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 27)
- Re: Alert payloads not matching alert rules Paul Melson (Nov 27)