Re: snort 1.9.0 memleaking ?

[pilsl () goldfisch at]

On Wed, Nov 27, 2002 at 10:56:24AM -0800, Erek Adams wrote:
> It's not a memleak.
>
> It's stream4, conversation and portscan2.  They track connections and need
> a lot of memory to keep all the info in.  You can change the memory usage
> by setting the 'memcap' options in snort.conf for the preprocessor(s) in
> question.  You can also drop the number of conversations that are stored
> by using 'max_conversations'

Any place to find "reasonable" numbers for these settings. I have two
snort-daemons and each one (in default-config) eats up to 60MB Ram
which is imho too much.  If I reduce them to 10MB : would this
decrease securitylevel then cause less conversations can be monitored
?  And after all : what values should I set to gain maximum
performance and using not more than 10-15MB. (Or do I ask for the
impossible ?)

thnx,
peter


-- 
mag. peter pilsl
IT-Consulting
tel: +43-699-1-3574035
fax: +43-699-4-3574035
pilsl () goldfisch at
http://www.goldfisch.at


-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users