Re: [Snort-users] ip_queue question

["Will Metcalf" <william.metcalf@gmail.com>]

You can increase the queue length, but if you are queueing that many packets I think you may be sending more traffic to snort than it can handle.  Either way you can increase the queue length by tweaking
 

/proc/sys/net/ipv4/ip_queue_maxlen

 

Regards,

 

Will

 

 

 

On 3/23/07, Josep Román <josep.roman@gmail.com> wrote:

Hi there,

Using snort 2.6.1.3 in inline mode I'm getting the following messages in one
of the systems:

...
ip_queue: full at 1024 entries, dropping packets(s). Dropped: 10
ip_queue: full at 1024 entries, dropping packets(s). Dropped: 11
ip_queue: full at 1024 entries, dropping packets(s). Dropped: 12
...

What does exactly mean? From what I've found so far, it seems the ip_queue
detects the user's space kernel is full (i.e. Snort is not handling with the
whole traffic) and therefore, some packets are discarded.

Could anyone please confirm that and also shed some light on how to prevent
that?

TIA,

Josep


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users