Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram?

[Michael Altizer <xiche () verizon net>]

On 01/29/2011 09:02 PM, Michael Scheidell wrote:
> looking to make sure the snort/freebsd ports I am working on is 
> actually using the daq libraries.
>
> snort --daq-list
> Available DAQ modules:
> pcap(v3): readback live multi unpriv
> ipfw(v2): live inline multi unpriv
> dump(v1): readback live inline multi unpriv
>
> start snort with:
> -dDqI -m 022 -k none --nolock-pidfile --daq pcap --daq-var 
> buffer_size=524288
>
> top with and without doesn't show anything close to using 512Mb of ram.
>
> so, how do I tell if it actually allocated the ram? and is using it?
>
> before snort running:
> top:  2913M
> sysctl -a | grep 'Free Memory Pages'
> Free Memory Pages:    2985284K
>
> after two copies of snort running:
>
> top: 2661M
> sysctl -a | grep 'Free Memory Pages'
> Free Memory Pages:    2723108K
>
> looks like just a little over 256M, basically, what snort was using 
> without specifying the buffer.
The buffer_size variable for the PCAP DAQ module is more of a "best 
effort" thing than anything else.  I call pcap_set_buffer_size() and 
then it's up to PCAP's implementation on your system to do its best to 
try to set aside that much memory for packet buffers if it can.  I 
honestly don't have experience with the libpcap codepath for FreeBSD, so 
I don't know if it even tries to use that.  Heads up though, the value 
is in bytes.  So what you requested was 512kb.

-Michael

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users