freebsd/snort 2.9.0.3 daq: how do I verify it is using the ram?

[Michael Scheidell <michael.scheidell () secnap com>]

looking to make sure the snort/freebsd ports I am working on is actually 
using the daq libraries.

snort --daq-list
Available DAQ modules:
pcap(v3): readback live multi unpriv
ipfw(v2): live inline multi unpriv
dump(v1): readback live inline multi unpriv

start snort with:
-dDqI -m 022 -k none --nolock-pidfile --daq pcap --daq-var 
buffer_size=524288

top with and without doesn't show anything close to using 512Mb of ram.

so, how do I tell if it actually allocated the ram? and is using it?

before snort running:
top:  2913M
sysctl -a | grep 'Free Memory Pages'
Free Memory Pages:    2985284K

after two copies of snort running:

top: 2661M
sysctl -a | grep 'Free Memory Pages'
Free Memory Pages:    2723108K

looks like just a little over 256M, basically, what snort was using 
without specifying the buffer.


--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation

   * Certified SNORT Integrator
   * 2008-9 Hot Company Award Winner, World Executive Alliance
   * Five-Star Partner Program 2009, VARBusiness
   * Best in Email Security,2010: Network Products Guide
   * King of Spam Filters, SC Magazine 2008


______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users