Snort mailing list archives
No memory error
From: "Sutton, Andrew" <andrew.sutton () cocc com>
Date: Mon, 28 Apr 2003 14:05:37 -0400
Anyone seen this before? I've swapped out memory, reinstalled it, and it still bombs after about a minute or so. It works when using the "config detection: search-method lowmem" in the config file. I have the same package (other than a couple rules turned off) running on another box with no problems. Error: No memory - file : /usr/ports/net/snort/w-snort-2.0.0-mysql/snort-2.0.0/src/fpcreate.c pmx-content ! System: Snort 2.0.0 OpenBSD 3.1, 500mhz Processor, 384mb of memory Command line: /var/snort-2.0.0/snort -i xl0 -o -b -l /var/snort-2.0.0/logs \ -c /var/snort-2.0.0/snort.conf Output: $ sudo /var/snort/snort -i xl0 -o -b -l /var/snort/logs -c /var/snort/snort.conf Running in IDS mode Log directory = /var/snort/logs Initializing Network Interface xl0 --== Initializing Snort ==-- Rule application order changed to Pass->Alert->Log Initializing Output Plugins! Decoding Ethernet on interface xl0 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /var/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Conversation Config: KeepStats: 0 Conv Count: 3000 Timeout : 60 Alert Odd?: 0 Allowed IP Protocols: All Portscan2 config: log: /var/snort/logs/scan.log scanners_max: 256 targets_max: 1024 target_limit: 10 port_limit: 20 timeout: 60 database: compiled support for ( mysql ) database: configured to use mysql database: user = snort database: password is set database: database name = snort database: host = 10.1.1.3 database: sensor name = 10.1.1.2 database: sensor id = 4 database: schema version = 106 database: using the "alert" facility 1330 Snort rules read... 1330 Option Chains linked into 152 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->pass->activation->dynamic->alert->log --== Initialization Complete ==-- -*> Snort! <*- Version 2.0.0 (Build 72) By Martin Roesch (roesch at sourcefire.com, www.snort.org) No memory - file:/usr/ports/net/snort/w-snort-2.0.0-mysql/snort-2.0.0/src/fpcreate.c pmx-content ! *** This message originates from COCC, Inc. If the reader of this message, regardless of the address or routing, is not an intended recipient, you are hereby notified that you have received this transmittal in error and any review; use, distribution, dissemination or copying is strictly prohibited. If you have received this message in error, please delete this e-mail and all files transmitted with it from your system and immediately notify COCC, Inc. by sending reply e-mail to the sender of this message. Thank you. *** ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- No memory error Sutton, Andrew (Apr 28)
- <Possible follow-ups>
- RE: No memory error SRH-Lists (Apr 28)
- RE: No memory error Sutton, Andrew (Apr 28)
- RE: No memory error Erek Adams (Apr 29)