Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-users] 2.6.1 and LOOOONG startup times plusmoreignore_scanner

from [John York] Network Security [Permanent Link]
Subject: Re: [Snort-users] 2.6.1 and LOOOONG startup times plusmoreignore_scanners info
Date: Fri, 17 Nov 2006 12:01:29 -0500 
 

-----Original Message-----
From: James Lay [mailto:jlay@slave-tothe-box.net] 
Sent: Friday, November 17, 2006 11:17 AM
To: 'Snort'
Subject: Re: [Snort-users] 2.6.1 and LOOOONG startup times 
plusmoreignore_scanners info

And HOLY SMACKERS!  Ac-bnfa sure made a difference!  Tested 
with that and
now snort is using 9% of memory, and init time was less then a minute!


HOLY SMACKERS indeed!  I was having similar problems--thought my snort
had gone into an infinite loop since it took so long to start.  ac-bnfa
made no sense to me, so I RTFM.  No help there, so in desparation I
RTFRL.  There I found this:
    * Smaller memory footprint pattern mattcher using Aho-Corasick,
      using NFA.  Use 'config detection: search-method ac-bnfa' to 
      enable.  This will become the default pattern matcher in future
      releases.  Wu-Manhber has been deprecated (mwm).
Now life is good again (more or less.)
Thanks
John

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-users] 2.6.1 and LOOOONG startup times plus moreignore_scanners info, James Lay
Next by Date:  Re: [Snort-users] Is there any documentation showing how to write a snort plugin?, John Draper
Previous by Thread:  Re: [Snort-users] 2.6.1 and LOOOONG startup times plus moreignore_scanners info, James Lay
Next by Thread:  Re: [Snort-users] 2.6.1 and LOOOONG startup times plus more ignore_scanners info, Nigel Houghton
Indexes:  [Date] [Thread] [Top] [All Lists]