Re: [Fwd: snort-2.6rc1 using a lot of memory]

["Nerijus Krukauskas" <nkrukauskas () gmail com>]

On 19/04/06, Steven Sturges <steve.sturges () sourcefire com> wrote:
> Nerijus--
>
> As noted in the RELEASE.NOTES, there was a change in the
> default pattern matching engine from Wu-Manber to standard
> Aho-Corasick which is faster but consumes more memory.

  Right, found that.

> The Aho-Corasick implementation in snort has a few different
> memory models, standard, full, banded, sparse, and sparse
> banded.  The sparse and spare-banded ones consume much less
> memory... To use them, add a snort.conf line, as desired,
> for example.  Wu-Manber is being deprecated in the next
> release.
>
> config detection: search-method ac-sparsebands

  Found some explanations and possible values for search-method in
src/fpcreate.c. Would be nice to have that in snort_manual. Anyway,
thanks for clarifications and my test snort-2.6rc1 is now 204Mb of
resident size with ac-sparsebands.

--
http://nk99.org/


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users