Re: Snort and memory

[Martin Roesch <roesch () sourcefire com>]

What output options are you using?  

Marcin Zurakowski wrote:
> I've run snort on local network(ethernet - 10Mb/s and 2Mb/s gateway to
> internet). When I run 'top' I get:
>
> ---------------------------------------------------------------------
> CPU states: 15.6% user,  3.3% system,  0.0% nice, 80.9% idle
> Mem:   160824K av,  158496K used,    2328K free,   27992K shrd,    3944K
> buff
> Swap:  128516K av,   59144K used,   69372K free                    9708K
> cached
>
>   PID USER     PRI  NI  SIZE  RSS SHARE STAT  LIB %CPU %MEM   TIME COMMAND
> 28156 snort     19   0  170M 113M   968 R       0 16.6 72.4 264:03 snort
> 31665 root       4   0   868  868   672 R       0  1.9  0.5   0:26 top
> -----------------------------------------------------------------------
>
> Is it normal that snort consumed 170MB memory??????????
>
> Configuration:
> - Pentium MMX 166MHz
> - 160MB memory
> - 128 MB swap
> - network adapter: 3COM 905C
> - RH 6.0, kernel 2.2.19 with openwall patch
> - snort 1.8.1-RELEASE
> - standart configuration from whitehats, internal network: class C
>
> --
>
> Marcin Zurakowski
>
> InterFirma Administrator
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users