Snort mailing list archives
Re: Snort slurps memory
From: Erek Adams <erek () snort org>
Date: Fri, 31 Jan 2003 09:04:22 -0500 (EST)
On Fri, 31 Jan 2003, Maarten de Vries wrote:
If this has been discussed before I apologize, but I haven't found an answer in the archives so far.
It's there... I know, I've answered it before. ;-)
Ever since we upgraded to 1.9.0, the amount of memory Snort uses has increased dramatically. The total size of the process was never more than about 8Mb, however, Snort now seems to occupy around 50Mb. Can anyone tell me why the process has grown so incredibly large?
Yep. Sure can. spp_conversation and spp_stream4. They both grab large chunks of memory to handle all of the stateful detection and flow information. Check the FAQ [0] for a question regarding how to configure it. To be honest, I wouldn't worry about it. You've got enough memory for that ~50MB not to be a problem unless you're on a heavily used (bunch of other apps) box. Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson [0] http://www.snort.org/docs/faq.html#3.14 ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort slurps memory Maarten de Vries (Jan 31)
- Re: Snort slurps memory Erek Adams (Jan 31)
- Re: Snort slurps memory Matt Kettler (Jan 31)