Re: Bug in spp_session.c/initSessionCache? (assigning value to cleanup_sessions)

["Gaurav Nagare (gnagare)" <gnagare () cisco com>]

Hello James,


Thanks for sharing your observations. We'll take a look and try to address in next release.

However, as you may have noted from code and snort.conf that default value for `max_sessions` is much higher hence 
would not cause `cleanup_session > max_sessions`.


Thanks

Gaurav

From: James McLaughlin <jmclaughlin () maxeler com<mailto:jmclaughlin () maxeler com>>
Date: Monday, 25 April 2016 at 8:57 PM
To: "snort-devel () lists sourceforge net<mailto:snort-devel () lists sourceforge net>" <snort-devel () lists 
sourceforge net<mailto:snort-devel () lists sourceforge net>>
Subject: [Snort-devel] Bug in spp_session.c/initSessionCache? (assigning value to cleanup_sessions)

In initSessionCache, we have the following block of code:

            if( cleanup_sessions < ( 2 * max_sessions ) )
                sessionCache->cleanup_sessions = cleanup_sessions;
            else
                sessionCache->cleanup_sessions = ( max_sessions / 2 );
            if( sessionCache->cleanup_sessions == 0 )
                sessionCache->cleanup_sessions = 1;

Going by the contents of the else block, the low default value of cleanup_sessions, and the fact that this allows 
cleanup_sessions to exceed max_sessions... this looks like it should begin:

            if( (2 * cleanup_sessions) <= max_sessions)

James.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!