Re: Snort with low mem

[Todd Wease <twease () sourcefire com>]

Hi Parag,

Depending on the ruleset, ac-bnfa may use less memory than lowmem.  
Snort 2.8.6 adds a new option "split-any-any" that can drastically 
reduce memory depending on the amount of any-any port rules.  I'd give 
that a try to see if it helps.

Todd

On 06/09/2010 08:06 AM, Parag Pote wrote:
> Anybody has any idea from devel team? I am using 2.8.5 and lowmem doesn't seem to be working for me. Taking same 
> memory as without it.
>
> Any help is greatly appreciated.
>
> Parag
>
> --- On Thu, 5/20/10, Joel Esler<jesler () sourcefire com>  wrote:
>
>    
> > From: Joel Esler<jesler () sourcefire com>
> > Subject: Re: [Snort-users] Snort with low mem
> > To: "Parag Pote"<pipsparag () yahoo com>
> > Cc: snort-users () lists sourceforge net
> > Date: Thursday, May 20, 2010, 9:35 AM
> > I don't *think* anything has changed
> > in the lowmem search method in recent releases, maybe
> > someone from devel can comment on it, however, in 2.8.6, we
> > have a new bnfa search method which is faster and uses less
> > memory than before.  Might want to check that one out.
> >
> >
> > On May 20, 2010, at 8:17 AM, Parag Pote wrote:
> >
> >      
> > > Hi,
> > >
> > > I am using snort 2.8.5. I tried running snort with and
> > >        
> > without
> >      
> > > config detection: serach-method lowmem
> > >
> > > But with both the memory required is same. I remember
> > >        
> > in earlier version(long back 2.3.0) I used to see less
> > memory requirement with lowmem algorithm. Is something
> > changed in recent releases?
> >      
> > > Rgds,
> > > Parag
> > >
> > >
> > >
> > >
> > >
> > >
> > >        
> > ------------------------------------------------------------------------------
> >      
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >        
> > --
> > Joel Esler
> >
> >
> >
> >
> >
> >
> >
> >
> >      
>
>
>
>
> ------------------------------------------------------------------------------
> ThinkGeek and WIRED's GeekDad team up for the Ultimate
> GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
> lucky parental unit.  See the prize list and enter to win:
> http://p.sf.net/sfu/thinkgeek-promo
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>    


------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users