Re: Snort 2.6.0RC1 memory usage on FreeBSD

[Jason Brvenik <jasonb () sourcefire com>]

Here is the mail from Steve Sturgess from a few weeks ago on the matter.

-------- Original Message --------
Subject: Re: [Fwd: [Snort-users] snort-2.6rc1 using a lot of memory]
Date: Wed, 19 Apr 2006 09:30:05 -0400
From: Steven Sturges [steve.sturges at sourcefire.com]
To: nkrukauskas at gmail.com
CC: Jennifer Steffens [jennifer.steffens at sourcefire.com],    snort-beta
at sourcefire.com, snort-users at lists.sourceforge.net
References: <444638F8.2070304 () sourcefire com>

Nerijus--

As noted in the RELEASE.NOTES, there was a change in the
default pattern matching engine from Wu-Manber to standard
Aho-Corasick which is faster but consumes more memory.

This effectively replaced an implicit config of

config detection: search-method mwm

with

config detection: search-method ac

The Aho-Corasick implementation in snort has a few different
memory models, standard, full, banded, sparse, and sparse
banded.  The sparse and spare-banded ones consume much less
memory... To use them, add a snort.conf line, as desired,
for example.  Wu-Manber is being deprecated in the next
release.

config detection: search-method ac-sparsebands

There is also the lowmem method, which is slow, but uses
very little memory.

Cheers.
-steve

Richard Bejtlich wrote:
> Hello,
>
> Has anyone else tried Snort 2.6.0RC1 on FreeBSD 6.0?
>
> uname -a
> FreeBSD orr.taosecurity.com 6.0-SECURITY FreeBSD 6.0-SECURITY #0: Tue
> Apr 18 08:56:09 UTC 2006   
> root () builder daemonology net:/usr/obj/usr/src/sys/GENERIC  i386
>
> I've tried compiling it with 3 different variations, namely:
>
> --enable-ipfw --enable-perfprofiling --enable-dynamicplugin
> --enable-perfprofiling --enable-dynamicplugin
> --enable-dynamicplugin
>
> and then running it like so:
>
> snort -i <interface> -c etc/snort.conf -l .
> --dynamic-preprocessor-lib-dir
> /usr/local/lib/snort_dynamicpreprocessor
>
> snort.conf is literally the unaltered snort.conf in the distro.  Rules
> are the current snapshot.
>
> All three different compilations result in Snort using 183 MB of
> memory while running.  This is over twice what Snort 2.4.4 occupies on
> the same hardware.  I'd just like to know if this is normal, perhaps
> as a result of the dynamic preprocessors?
>
> Does anyone have a different experience?
>
> BTW I tried this on two different i386 systems -- same results.
>
> Thank you,
>
> Richard
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users

-- 
Jason Brvenik - Sourcefire
PGP: 89C6 DE77 3B32 FC03 A5AE B5DD 11DF 4C8B 0D8E 3383
Key: http://cerberus.sourcefire.com/~jbrvenik/jason.brvenik.pgp.key


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users