stream4 memory questions.

[Vjay LaRosa <vjayl () emc com>]

Hello,

I have two questions...

1)

Can some one tell me if there is a memory cap for the preprocessors
frag2 and streams4? I want to make sure that each snort process on my
server
has MORE than enough memory than it needs (6 GB in the server!).

Currently I can see one process uses up to 147 MB of memory,

14967 root       1  40    0   27M   27M run   303:39 17.82% snort
14972 root       1  31    0  147M  147M sleep 235:55 14.28% snort <----
14962 root       1  52    0   18M   18M sleep 244:12  8.59% snort

These are my snort.conf settings.

preprocessor frag2: memcap 134217728, timeout 60 # 128 MB
preprocessor stream4: detect_scans, memcap 134217728 # 128 MB


2)
Could some one explain the following lines of output to me? They are
from a kill -USR1 to a snort process.

Stream Trackers
Stream Flushes
Segments used
Stream4 Memory faults

TCP Stream Reassembly Stats:
        TCP Packets Used: 84060320   (91.651%)
         Stream Trackers: 4677076
          Stream flushes: 20
           Segments used: 310
   Stream4 Memory Faults: 542


--
 V.Jay LaRosa                           EMC Corporation
 Systems Administrator                  171 South Street
 (508)435-1000 ext 14957                Hopkinton, MA 01748
 (508)497-8082 fax                      www.emc.com




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users