Snort mailing list archives
ip_queue question
From: Josep Román <josep.roman () gmail com>
Date: Sat, 24 Mar 2007 00:19:17 +0100
Hi there, Using snort 2.6.1.3 in inline mode I'm getting the following messages in one of the systems: ... ip_queue: full at 1024 entries, dropping packets(s). Dropped: 10 ip_queue: full at 1024 entries, dropping packets(s). Dropped: 11 ip_queue: full at 1024 entries, dropping packets(s). Dropped: 12 ... What does exactly mean? From what I've found so far, it seems the ip_queue detects the user's space kernel is full (i.e. Snort is not handling with the whole traffic) and therefore, some packets are discarded. Could anyone please confirm that and also shed some light on how to prevent that? TIA, Josep ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ip_queue question Josep Román (Mar 23)
- Re: ip_queue question Will Metcalf (Mar 24)