Getting tuned finally!

["Jefferson, Shawn" <Shawn.Jefferson () bcferries com>]

So I think I'm finally getting my snort sensor tuned so that I am achieving a balance between resources (not dropping 
any packets according to snorts.stats) and having some of the EmergingThreats rulesets enabled.  I do have some 
questions about the stream5 preprocessor though.

I noticed that I was getting "faults" occasionally, and subsequent messages in the daemon.log about pruning sessions, 
so I increased the memcap limit until these went away.  Is this a "correct" action to take?

Also, I noticed that my Open Sessions stats show open sessions to pretty much always be equal to max sessions, which is 
set at 8192.  Should I be increasing this, or is that normal behaviour?

Thanks,
Shawn



------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users