Snort mailing list archives
Re: ip_queue question
From: "Will Metcalf" <william.metcalf () gmail com>
Date: Sat, 24 Mar 2007 19:37:00 -0500
You can increase the queue length, but if you are queueing that many packets I think you may be sending more traffic to snort than it can handle. Either way you can increase the queue length by tweaking /proc/sys/net/ipv4/ip_queue_maxlen Regards, Will On 3/23/07, Josep Román <josep.roman () gmail com> wrote:
Hi there, Using snort 2.6.1.3 in inline mode I'm getting the following messages in one of the systems: ... ip_queue: full at 1024 entries, dropping packets(s). Dropped: 10 ip_queue: full at 1024 entries, dropping packets(s). Dropped: 11 ip_queue: full at 1024 entries, dropping packets(s). Dropped: 12 ... What does exactly mean? From what I've found so far, it seems the ip_queue detects the user's space kernel is full (i.e. Snort is not handling with the whole traffic) and therefore, some packets are discarded. Could anyone please confirm that and also shed some light on how to prevent that? TIA, Josep ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ip_queue question Josep Román (Mar 23)
- Re: ip_queue question Will Metcalf (Mar 24)