Snort mailing list archives
Re: PCAP_MEMORY issue
From: "Jefferson, Shawn" <Shawn.Jefferson () bcferries com>
Date: Tue, 3 Mar 2009 10:29:42 -0700
Hi, Tasks: 74 total, 2 running, 72 sleeping, 0 stopped, 0 zombie Cpu(s): 14.6%us, 0.4%sy, 0.0%ni, 83.4%id, 0.0%wa, 0.0%hi, 1.5%si, 0.0%st Mem: 3115832k total, 1349952k used, 1765880k free, 9468k buffers Swap: 2939852k total, 0k used, 2939852k free, 137108k cached Linux <servername> 2.6.24-23-server #1 SMP Mon Jan 26 00:55:21 UTC 2009 i686 GNU/Linux Ubuntu 8.04, which I think has slab (??). I googled some on memory fragmentation, and found some commands to check for memory fragmentation, but I'm not totally sure what I'm looking at. root@server:~# vmstat -s 3115832 K total memory 1343616 K used memory 397572 K active memory 68328 K inactive memory 1772216 K free memory 8872 K buffer memory 131760 K swap cache 2939852 K total swap 0 K used swap 2939852 K free swap 18577114 non-nice user cpu ticks 0 nice user cpu ticks 473536 system cpu ticks 185481446 idle cpu ticks 134474 IO-wait cpu ticks 144290 IRQ cpu ticks 358175 softirq cpu ticks 0 stolen cpu ticks 670958 pages paged in 31155560 pages paged out 0 pages swapped in 0 pages swapped out 1751057950 interrupts 1437711074 CPU context switches 1235604996 boot time 25810 forks root@server:~# grep Normal /var/log/messages | tail -1 Mar 3 09:19:04 servername kernel: [495516.650157] Normal: 651*4kB 5*8kB 1*16kB 1*32kB 1*64kB 1*128kB 1*256kB 1*512kB 1*1024kB 0*2048kB 0*4096kB = 4676kB I only have 3GB total memory in this machine at the moment. -----Original Message----- From: Stephen John Smoogen [mailto:smooge () gmail com] Sent: February 26, 2009 12:27 PM To: Jefferson, Shawn Cc: Snort-users () lists sourceforge net Subject: Re: [Snort-users] PCAP_MEMORY issue On Tue, Feb 24, 2009 at 1:49 PM, Jefferson, Shawn <Shawn.Jefferson () bcferries com> wrote:
I'm using PCAP_MEMORY, and the highest I can seem to go is: PCAP_MEMORY=800000 If I try to increase it, I get error messages when snort is starting: Error: setsockopt(PACKET_RX_RING): Cannot allocate memory However, running top shows I've got 1.8 GB of memory left available on this machine. Is there something else I need to tweak to allow a higher amount of memory for libpcap? PS. I'm using Phil Wood's libpcap.
What is the system stats? CPU, kernel version, total memory, and does the system have slab, slub, or some other memory allocation in use? [I don't know how to tell this myself.. my systems are old enough to only have slab.. but the new kernels would have access to different memory allocations.] My guess is that one of the following is occuring: Not enough continguous memory. Contiguous Memory is not in a directly mappable zone. (If you have a 4+GB machine and you are trying to do this on a 32 bit architecture) -- Stephen J Smoogen. -- BSD/GNU/Linux How far that little candle throws his beams! So shines a good deed in a naughty world. = Shakespeare. "The Merchant of Venice" ------------------------------------------------------------------------------ Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise -Strategies to boost innovation and cut costs with open source participation -Receive a $600 discount off the registration fee with the source code: SFAD http://p.sf.net/sfu/XcvMzF8H _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- PCAP_MEMORY issue Jefferson, Shawn (Feb 24)
- Re: PCAP_MEMORY issue Stephen John Smoogen (Feb 26)
- Re: PCAP_MEMORY issue Jefferson, Shawn (Mar 03)
- <Possible follow-ups>
- Re: PCAP_MEMORY issue Phil Wood (Feb 25)
- Re: PCAP_MEMORY issue Stephen John Smoogen (Feb 26)