Snort mailing list archives

Re: Barnyard2 -ERROR: Unable to allocate memory! (3737895080 requested)


From: wkitty42 () windstream net
Date: Fri, 2 Jun 2017 16:16:27 -0400

On 06/02/2017 12:38 AM, ‫moon sun‬ ‫ wrote:
  I used hping3 to simulate Dos attackby  :
$ sudo hping3example.com -c 10000 -d 120 -S -w 64 --flood -p 80
And i logged it by snort to log file.

Then I used barnyard2 to send this log file to snort mysql , but it give me this error :


ERROR: Unable to allocate memory!  (3737895080 requested)
Fatal Error, Quitting..
Barnyard2 exiting
database: Closing connection to database "snort"

before simulating the dos attack and logged it , it was work fine.
Why this happen and how can I fix it?

it is trying to allocate 3Gig of RAM... i'd imagine that that's a pretty large U2 file it is trying to deal with...


FWIW: quoting from https://github.com/firnsy/barnyard2

------------------------------------------------------------------------------
4. CONTACT
------------------------------------------------------------------------------

You can contact the barnyard2 team and user base for question/help debugging issue concerning barnyard2 by using our mailing lists.

barnyard2-users () googlegroups com
AND
barnyard2-devel () googlegroups com



--
 NOTE: No off-list assistance is given without prior approval.
       *Please keep mailing list traffic on the list unless*
       *a signed and pre-paid contract is in effect with us.*

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Current thread: