Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: [Snort-users] Alert payloads not matching alert rules |
|---|---|
| Date: | Thu, 23 Nov 2006 09:21:51 +1300 |
Joel Esler wrote:
Are you dropping any packets? It seems that with 3 processes of Snort, on the same box, with only 2 Gigs of RAM trying to analyze that much traffic, you are probably dropping packets in addition to Snort overwriting its own memory.
Hi Joel Can you explain what you mean by snort overwriting it's own memory? How is that possible? I thought standard OS process separation would stop that? (I am assuming you meant having >1 snort process leads to one snort process "corrupting" another) I also routinely run multiple snort instances - this comes as a bit of a shock... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: [Snort-users] Alert payloads not matching alert rules, Joel Esler |
|---|---|
| Next by Date: | Re: [Snort-users] Alert payloads not matching alert rules, Marc Norton |
| Previous by Thread: | Re: [Snort-users] Alert payloads not matching alert rules, Joel Esler |
| Next by Thread: | Re: [Snort-users] Alert payloads not matching alert rules, Joel Esler |
| Indexes: | [Date] [Thread] [Top] [All Lists] |