Jason Haar wrote:
I have been putting off upgrading our snort network from 2.4X to 2.6 for
ages because we run a fairly full ruleset and I saw memory usage leap
between the two versions.
e.g. I just tried out 2.6.0.2 and our snort installs hit 850MB RAM per
process - owch! (under RHE4). This compares with 240MB under 2.4X
However, if I enable the line "config detection: search-method lowmem",
memory utilization under 2.6 falls waaaaay down to <100MB.
Sounds too good to be true. What am I missing out on by doing such an
action? And if this sort of memory usage is expected, is everyone just
putting in 4G RAM to deal with this sort of thing?
Thanks
Below is a cut and paste from a mail Marc Norton sent to the snort-devel
list. [0] It should make it more clear.
In 2.6.0 we use the ac method, it is the fastest, but does consume more
memory and takes some initial resources to build the DFA it uses. The
acs/ac-banded/and ac-sparsebands/mwm/lowmem methods each use less
memory, than the ac or ac-std methods. However, we do not recommend mwm
as it poses some DOS opportunities with repeated patterns. The low mem
method is about 20% slower than the faster methods, but uses very little
memory and very little initial resources. Of couse you can also revert
to the ac-std method that has been in use since 2.0 as well. It's
startup is about 3x faster than the other ac methods.
Memory usage most to least is:
ac-std
ac
ac-banded
ac-sparsebands
mwm
acs
lowmem
startup processing most to least is
most
-----
ac
ac-banded
ac-sparsebands
acs
moderate
---------
ac-std
very little
---------
mwm
lowmem
[0] - http://marc2.theaimsgroup.com/?l=snort-devel&m=115627559410302&w=3
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
