Re: Memory usage on Snort

["Andrew R. Baker" <andrewb0x29a () yahoo com>]

Easy solution, don't use stream2, use stream4 instead.  stream2 is known
to have problems and all development on it has stopped.  Maybe i can
convince Marty to let me remove it from the current codebase.

-A


--- Scott Nursten <scott.nursten () StreetsOnline co uk> wrote:
> Hey guys, 
>
> Don't know if this has been mentioned before, but using 
>
> preprocessor stream2: timeout 10, ports 25 80, maxbytes 16384
>
> makes snort run away with 1.4GB of memory in under 12 hours on our net'.
> Once this is disabled, snort has not used more then 5.2MB of mem in 24
> hours. 
>
> Any fixes - BTW I searched the archives for any stream2 complaints -
> there were a few complaints about memory usage, but no fixes. 
http://www.geocrawler.com/search/?config=4890&words=stream2&SUBMIT=Search+snort-users
> Rgds,
>
> Scott 
> -- 
>
> Scott Nursten - Systems Administrator
> ----------------------------------------------
> ddi:   +44 (0) 1293 744 122
> work:  +44 (0) 1293 402 040
> fax:   +44 (0) 1293 402 050
> email: scottn () streetsonline co uk
> wwweb: http://www.streetsonline.co.uk
> ----------------------------------------------
>
>               Any sufficiently advanced technology is indistinguishable from magic.
>                                       Arthur C. Clarke
>
>               Any technology distinguishable from magic is insufficiently advanced.
>                        (Probably not) Arthur C. Clarke
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


__________________________________________________
Do You Yahoo!?
Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger
http://im.yahoo.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users