[Snort-users] ip_queue question

[Josep Román <josep.roman@gmail.com>]

Hi there,

Using snort 2.6.1.3 in inline mode I'm getting the following messages in one
of the systems:

...
ip_queue: full at 1024 entries, dropping packets(s). Dropped: 10
ip_queue: full at 1024 entries, dropping packets(s). Dropped: 11
ip_queue: full at 1024 entries, dropping packets(s). Dropped: 12
...

What does exactly mean? From what I've found so far, it seems the ip_queue
detects the user's space kernel is full (i.e. Snort is not handling with the
whole traffic) and therefore, some packets are discarded.

Could anyone please confirm that and also shed some light on how to prevent
that?

TIA,

Josep 


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users