[Snort-users] memory leak in Snort 1.8.7?

Matthew Harrell mhar at ...7038...
Thu Oct 3 10:02:03 EDT 2002

Here's my setup:

I'm running Mandrake Linux 9.0 on a Pentium 200 with 64 MB RAM.  I'm
running snort-1.8.7-3mdk.rpm.  A little while ago, I changed two things.  I
upgraded from Mandrake Linux 9.0beta2 to 9.0, and I changed the switch port
that this box is on so that it hears traffic on all of the ports on that
switch.  Since then, obviously, I've seen greatly increased scans in Snort
(about 1 to 2 unique IP numbers an hour, but it varies).

Before these two things were changed, Snort ran just fine, not using up a
significant amount of memory.  Now, Snort gradually consumes all spare RAM
and VRAM (which is set at 256 MB).  It seems to take about 24 hours for it
to use up all the swap space.  The system gets gradually slower and slower
until it's just about unusable.

Now, is this a memory leak, or is Snort just going to need a HUGE amount of
RAM due to the increased traffic it sees?

Matt Harrell
Plexus Systems
mhar at ...7038...

More information about the Snort-users mailing list