Re: PCAP_MEMORY issue

[Stephen John Smoogen <smooge () gmail com>]

On Tue, Feb 24, 2009 at 1:49 PM, Jefferson, Shawn
<Shawn.Jefferson () bcferries com> wrote:
> I’m using PCAP_MEMORY, and the highest I can seem to go is:
> PCAP_MEMORY=800000
>
> If I try to increase it, I get error messages when snort is starting:
> Error: setsockopt(PACKET_RX_RING): Cannot allocate memory
>
> However, running top shows I’ve got 1.8 GB of memory left available on this
> machine.  Is there something else I need to tweak to allow a higher amount
> of memory for libpcap?
>
> PS. I’m using Phil Wood’s libpcap.

What is the system stats? CPU, kernel version, total memory, and does
the system have slab, slub, or some other memory allocation in use? [I
don't know how to tell this myself.. my systems are old enough to only
have slab.. but the new kernels would have access to different memory
allocations.] My guess is that one of the following is occuring:

Not enough continguous memory.
Contiguous Memory is not in a directly mappable zone. (If you have a
4+GB machine and you are trying to do this on a 32 bit architecture)

-- 
Stephen J Smoogen. -- BSD/GNU/Linux
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users