No memory error

["Sutton, Andrew" <andrew.sutton () cocc com>]

Anyone seen this before?  I've swapped out memory, reinstalled it, and it
still bombs after about a minute or so.  It works when using the "config
detection: search-method lowmem" in the config file.  I have the same
package (other than a couple rules turned off) running on another box with
no problems.  

Error:
No memory - file :
/usr/ports/net/snort/w-snort-2.0.0-mysql/snort-2.0.0/src/fpcreate.c
pmx-content !

System:
Snort 2.0.0
OpenBSD 3.1, 500mhz Processor, 384mb of memory

Command line:
/var/snort-2.0.0/snort -i xl0 -o -b -l /var/snort-2.0.0/logs \
    -c /var/snort-2.0.0/snort.conf

Output:
$ sudo /var/snort/snort -i xl0 -o -b -l /var/snort/logs -c
/var/snort/snort.conf    
Running in IDS mode
Log directory = /var/snort/logs

Initializing Network Interface xl0

        --== Initializing Snort ==--
Rule application order changed to Pass->Alert->Log
Initializing Output Plugins!
Decoding Ethernet on interface xl0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /var/snort/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Ports: 21 23 25 53 80 110 111 143 513 1433 
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 
http_decode arguments:
    Unicode decoding
    IIS alternate Unicode decoding
    IIS double encoding vuln
    Flip backslash to slash
    Include additional whitespace separators
    Ports to decode http on: 80 
rpc_decode arguments:
    Ports to decode RPC on: 111 32771 
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119 
Conversation Config:
   KeepStats: 0
   Conv Count: 3000
   Timeout   : 60
   Alert Odd?: 0
   Allowed IP Protocols:  All

Portscan2 config:
    log: /var/snort/logs/scan.log
    scanners_max: 256
    targets_max: 1024
    target_limit: 10
    port_limit: 20
    timeout: 60
database: compiled support for ( mysql )
database: configured to use mysql
database:          user = snort
database: password is set
database: database name = snort
database:          host = 10.1.1.3
database:   sensor name = 10.1.1.2
database:     sensor id = 4
database: schema version = 106
database: using the "alert" facility
1330 Snort rules read...
1330 Option Chains linked into 152 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Rule application order: ->pass->activation->dynamic->alert->log

        --== Initialization Complete ==--

-*> Snort! <*-
Version 2.0.0 (Build 72)
By Martin Roesch (roesch at sourcefire.com, www.snort.org)
No memory -
file:/usr/ports/net/snort/w-snort-2.0.0-mysql/snort-2.0.0/src/fpcreate.c
pmx-content !


*** This message originates from COCC, Inc.

If the reader of this message, regardless of the address or routing, is not an intended recipient, you are hereby 
notified that you have received this transmittal in error and any review; use, distribution, dissemination or copying 
is strictly prohibited.  If you have received this message in error, please delete this e-mail and all files 
transmitted with it from your system and immediately notify COCC, Inc. by sending reply e-mail to the sender of this 
message. 

Thank you. ***



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users