Snort mailing list archives
Re: Snort with low mem
From: Todd Wease <twease () sourcefire com>
Date: Fri, 11 Jun 2010 04:24:04 -0400
Hi Parag, Depending on the ruleset, ac-bnfa may use less memory than lowmem. Snort 2.8.6 adds a new option "split-any-any" that can drastically reduce memory depending on the amount of any-any port rules. I'd give that a try to see if it helps. Todd On 06/09/2010 08:06 AM, Parag Pote wrote:
Anybody has any idea from devel team? I am using 2.8.5 and lowmem doesn't seem to be working for me. Taking same memory as without it. Any help is greatly appreciated. Parag --- On Thu, 5/20/10, Joel Esler<jesler () sourcefire com> wrote:From: Joel Esler<jesler () sourcefire com> Subject: Re: [Snort-users] Snort with low mem To: "Parag Pote"<pipsparag () yahoo com> Cc: snort-users () lists sourceforge net Date: Thursday, May 20, 2010, 9:35 AM I don't *think* anything has changed in the lowmem search method in recent releases, maybe someone from devel can comment on it, however, in 2.8.6, we have a new bnfa search method which is faster and uses less memory than before. Might want to check that one out. On May 20, 2010, at 8:17 AM, Parag Pote wrote:Hi, I am using snort 2.8.5. I tried running snort with andwithoutconfig detection: serach-method lowmem But with both the memory required is same. I rememberin earlier version(long back 2.3.0) I used to see less memory requirement with lowmem algorithm. Is something changed in recent releases?Rgds, Parag------------------------------------------------------------------------------_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users-- Joel Esler------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort with low mem Parag Pote (May 20)
- Re: Snort with low mem Joel Esler (May 20)
- Re: Snort with low mem Jefferson, Shawn (May 20)
- Re: Snort with low mem Parag Pote (Jun 09)
- Re: Snort with low mem Todd Wease (Jun 11)
- Re: Snort with low mem Joel Esler (May 20)