On 10/31/06, Jason J. Ellingson <[EMAIL PROTECTED]> wrote:
Snort worked fine until I installed 1.0.1 (from 1.0)
Now, I see the normal startup messages for snort in the system logs and
get the usual memory and CPU use as before, but nothing seems to
actually trigger a snort alert or add anything to the blocked list.
I tried uninstalling and reinstalling the package, but that didn't help.
I also tried different modes (ac, lowmem, and sparseband)
Is there something I can run to help figure this out?
Snort is quite a hog. Unless you have selected a proper memory mode
then you won't see much of anything. To get anything of value you
need the ac-sparebands performance setting which requires a LOT of
ram. As the release notes state, you really should have a gig of ram
in your firewall if you plan on using snort correctly. In addition,
you need to define some sensible values in the Snort Advanced tab and
kick up the default bpf values. I generally * the defaults by 4-5 and
watch the memory increases.
Scott
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
