Re: freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram?

[Michael Scheidell <michael.scheidell () secnap com>]

On 1/30/11 12:13 PM, Frank Knobbe wrote:
> Run "netstat -B" to see what is using bpf. Run "sysctl net.bpf" for bpf
> memory settings.
 netstat -B
  Pid  Netif   Flags      Recv      Drop     Match Sblen Hblen Command
82514 trust1 p--s---   5038380         0   2858804  9446     0 snort
82516 untrust0 p--s---   6043253         0   3064206 12712     0 snort

sysctl net.bpf
net.bpf.maxinsns: 512
net.bpf.maxbufsize: 524288
net.bpf.bufsize: 4096


USER    PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
snort 82516  0.0  3.4 190404 142756  ??  Ss    7:56AM   0:59.63 
/usr/local/bin/snort -dDqI -m 022 -k none --nolock-pidfile --daq pcap 
--daq-var buffer_size=536870912 -c /etc/snort/snort_wan.conf -i untrust0 
-l /var/log/snort_wan -F /etc/snort/snort_wan.bpf

USER   PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
root 82514  0.0  3.3 184260 137936  ??  Ss    7:56AM   0:46.03 
/usr/local/bin/snort -dDqI -m 022 -k none --nolock-pidfile --daq pcap 
--daq-var buffer_size=536870912 -c /etc/snort/snort_lan.conf -i trust1 
-l /var/log/snort_lan -F /etc/snort/snort_lan.bpf

checking source:
grep -R pcap_set_buffer_size ./
./work/snort-2.9.0.3/src/win32/WIN32-Includes/WinPCAP/pcap/pcap.h:int    
pcap_set_buffer_size(pcap_t *, int);
Binary file ./work/snort-2.9.0.3/src/win32/WIN32-Prj/wpcap.dll matches
Binary file ./work/snort-2.9.0.3/src/win32/WIN32-Libraries/wpcap.lib matches
Binary file ./work/snort-2.9.0.3/src/snort matches

 grep -R pcap_set_buffer_size ./
./work/daq-0.5/os-daq-modules/daq_pcap.c:    to a buffer size I can pass 
to PCAP 1.0.0's pcap_set_buffer_size(). */
./work/daq-0.5/os-daq-modules/daq_pcap.c:        if ((status = 
pcap_set_buffer_size(context->handle, context->buffer_size)) < 0)
Binary file 
./work/daq-0.5/os-daq-modules/.libs/libdaq_static_modules_la-daq_pcap.o 
matches
Binary file ./work/daq-0.5/os-daq-modules/.libs/libdaq_static_modules.a 
matches
Binary file ./work/daq-0.5/os-daq-modules/.libs/daq_pcap_la-daq_pcap.o 
matches
Binary file ./work/daq-0.5/os-daq-modules/.libs/daq_pcap.so matches
Binary file 
./work/daq-0.5/os-daq-modules/libdaq_static_modules_la-daq_pcap.o matches
Binary file ./work/daq-0.5/os-daq-modules/daq_pcap_la-daq_pcap.o matches

 sysctl net.bpf.maxbufsize=1073741824
net.bpf.maxbufsize: 524288 -> 1073741824

restart snort.

same thing.

set it by hand:

sysctl net.bpf.bufsize=536870912
net.bpf.bufsize: 4096 -> 536870912
scanner2.secnap.com# sysctl net.bpf
net.bpf.maxinsns: 512
net.bpf.maxbufsize: 1073741824
net.bpf.bufsize: 536870912

restart snort.
so, I am still wondering if snort is using daq !



--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation

   * Certified SNORT Integrator
   * 2008-9 Hot Company Award Winner, World Executive Alliance
   * Five-Star Partner Program 2009, VARBusiness
   * Best in Email Security,2010: Network Products Guide
   * King of Spam Filters, SC Magazine 2008


______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users