Snort mailing list archives
stream4 memory questions.
From: Vjay LaRosa <vjayl () emc com>
Date: Thu, 14 Mar 2002 14:27:44 -0500
Hello, I have two questions... 1) Can some one tell me if there is a memory cap for the preprocessors frag2 and streams4? I want to make sure that each snort process on my server has MORE than enough memory than it needs (6 GB in the server!). Currently I can see one process uses up to 147 MB of memory, 14967 root 1 40 0 27M 27M run 303:39 17.82% snort 14972 root 1 31 0 147M 147M sleep 235:55 14.28% snort <---- 14962 root 1 52 0 18M 18M sleep 244:12 8.59% snort These are my snort.conf settings. preprocessor frag2: memcap 134217728, timeout 60 # 128 MB preprocessor stream4: detect_scans, memcap 134217728 # 128 MB 2) Could some one explain the following lines of output to me? They are from a kill -USR1 to a snort process. Stream Trackers Stream Flushes Segments used Stream4 Memory faults TCP Stream Reassembly Stats: TCP Packets Used: 84060320 (91.651%) Stream Trackers: 4677076 Stream flushes: 20 Segments used: 310 Stream4 Memory Faults: 542 -- V.Jay LaRosa EMC Corporation Systems Administrator 171 South Street (508)435-1000 ext 14957 Hopkinton, MA 01748 (508)497-8082 fax www.emc.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- stream4 memory questions. Vjay LaRosa (Mar 14)
- Re: stream4 memory questions. Martin Roesch (Mar 14)
- Re: stream4 memory questions. Vjay LaRosa (Mar 14)
- Re: stream4 memory questions. Martin Roesch (Mar 14)
- Re: stream4 memory questions. Vjay LaRosa (Mar 14)
- Re: stream4 memory questions. Martin Roesch (Mar 14)
- Re: stream4 memory questions. Vjay LaRosa (Mar 14)
- Re: stream4 memory questions. Martin Roesch (Mar 14)