Snort mailing list archives
Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram?
From: Michael Scheidell <michael.scheidell () secnap com>
Date: Sun, 30 Jan 2011 09:25:59 -0500
On 1/29/11 11:09 PM, Michael Altizer wrote:
The buffer_size variable for the PCAP DAQ module is more of a "best effort" thing than anything else. I call pcap_set_buffer_size() and then it's up to PCAP's implementation on your system to do its best to try to set aside that much memory for packet buffers if it can. I honestly don't have experience with the libpcap codepath for FreeBSD, so I don't know if it even tries to use that. Heads up though, the value is in bytes. So what you requested was 512kb.
ok, 512mb? USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMANDsnort 82516 0.0 3.4 190404 142664 ?? Ss 7:56AM 0:12.63 /usr/local/bin/snort -dDqI -m 022 -k none --nolock-pidfile --daq pcap --daq-var buffer_size=536870912 -c /etc/snort/snort_wan.conf -i untrust0 -l /var/log/snort_wan -F /etc/snort/snort_wan.bpf
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMANDroot 82514 0.0 3.3 184260 137688 ?? Ss 7:56AM 0:09.75 /usr/local/bin/snort -dDqI -m 022 -k none --nolock-pidfile --daq pcap --daq-var buffer_size=536870912 -c /etc/snort/snort_lan.conf -i trust1 -l /var/log/snort_lan -F /etc/snort/snort_lan.bpf
still, top/ sysctl does't show it using it.even through, it looks like its all there, and --enable-static-daq was used, that is why you don't see daq in the ldd list.
scanner2.secnap.com# snort -V ,,_ -*> Snort! <*- o" )~ Version 2.9.0.3 GRE (Build 98) FreeBSD'''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
Copyright (C) 1998-2010 Sourcefire, Inc., et al. Using libpcap version 1.1.1 Using PCRE version: 8.00 2009-10-19 Using ZLIB version: 1.2.3 scanner2.secnap.com# ldd /usr/local/bin/snort /usr/local/bin/snort: libdnet.1 => /usr/local/lib/libdnet.1 (0x800700000) libpcre.so.0 => /usr/local/lib/libpcre.so.0 (0x80080e000) libm.so.5 => /lib/libm.so.5 (0x80093e000) libsfbpf.so.0 => /usr/local/lib/libsfbpf.so.0 (0x800a58000) libpcap.so.1 => /usr/local/lib/libpcap.so.1 (0x800b7b000) libz.so.4 => /lib/libz.so.4 (0x800cab000) libthr.so.3 => /lib/libthr.so.3 (0x800dbf000) libc.so.7 => /lib/libc.so.7 (0x800ed6000)looks like I will have to parse through the init code and see if there is any 'antibsd' ifdef's.
-- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 ISN: 1259*1300 >*| *SECNAP Network Security Corporation * Certified SNORT Integrator * 2008-9 Hot Company Award Winner, World Executive Alliance * Five-Star Partner Program 2009, VARBusiness * Best in Email Security,2010: Network Products Guide * King of Spam Filters, SC Magazine 2008 ______________________________________________________________________This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
------------------------------------------------------------------------------ Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! Finally, a world-class log management solution at an even better price-free! Download using promo code Free_Logger_4_Dev2Dev. Offer expires February 28th, so secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 29)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Altizer (Jan 29)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Frank Knobbe (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Frank Knobbe (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Altizer (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 30)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Russ Combs (Jan 31)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Scheidell (Jan 31)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Russ Combs (Jan 31)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Altizer (Feb 01)
- Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram? Michael Altizer (Jan 29)