Snort mailing list archives
Re: Alert payloads not matching alert rules
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Thu, 23 Nov 2006 09:21:51 +1300
Joel Esler wrote:
Are you dropping any packets? It seems that with 3 processes of Snort, on the same box, with only 2 Gigs of RAM trying to analyze that much traffic, you are probably dropping packets in addition to Snort overwriting its own memory.
Hi Joel Can you explain what you mean by snort overwriting it's own memory? How is that possible? I thought standard OS process separation would stop that? (I am assuming you meant having >1 snort process leads to one snort process "corrupting" another) I also routinely run multiple snort instances - this comes as a bit of a shock... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Alert payloads not matching alert rules spagno_f (Nov 21)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 22)
- <Possible follow-ups>
- Re: Alert payloads not matching alert rules spagno_f (Nov 22)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 22)
- Re: Alert payloads not matching alert rules Jason Haar (Nov 22)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 27)
- Re: Alert payloads not matching alert rules Marc Norton (Nov 22)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 22)
- Re: Alert payloads not matching alert rules spagno_f (Nov 23)
- Re: Alert payloads not matching alert rules Joel Esler (Nov 27)
- Re: Alert payloads not matching alert rules Paul Melson (Nov 27)