This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[6.300] Snort gone berserk?

Hi!

After the patch was applied the CPU usage for snort_inline got skyhigh.
I appled it when i left work when i got home the load avarge in the graphs vas a peak at 11.

System is running realy slow. As soon as I disable IDS/IPS it stops. And calms down.

Please advice.

[SIZE=1]2006:06:30-15:41:16 (none) snort_inline: Reading from iptables
2006:06:30-15:41:16 (none) snort[7267]: Initializing daemon mode
2006:06:30-15:41:16 (none) snort[7268]: PID path stat checked out ok, PID path set to /var/run/
2006:06:30-15:41:16 (none) snort[7268]: Writing PID "7268" to file "/var/run//snort_inline.pid"
2006:06:30-15:41:16 (none) snort[7268]: Parsing Rules file /etc/snort/snort.conf
2006:06:30-15:41:16 (none) snort[7268]: Detection:
2006:06:30-15:41:16 (none) snort[7268]: Search-Method = AC-Sparse
2006:06:30-15:41:16 (none) snort[7268]: Stream4 config:
2006:06:30-15:41:16 (none) snort[7268]: Stateful inspection: ACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Session statistics: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Session timeout: 30 seconds
2006:06:30-15:41:16 (none) snort[7268]: Session memory cap: 8388608 bytes
2006:06:30-15:41:16 (none) snort[7268]: Session count max: 8192 sessions
2006:06:30-15:41:16 (none) snort[7268]: Session cleanup count: 5
2006:06:30-15:41:16 (none) snort[7268]: State alerts: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Evasion alerts: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Scan alerts: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Log Flushed Streams: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: MinTTL: 1
2006:06:30-15:41:16 (none) snort[7268]: TTL Limit: 5
2006:06:30-15:41:16 (none) snort[7268]: Async Link: 0
2006:06:30-15:41:16 (none) snort[7268]: State Protection: 0
2006:06:30-15:41:16 (none) snort[7268]: Self preservation threshold: 50
2006:06:30-15:41:16 (none) snort[7268]: Self preservation period: 90
2006:06:30-15:41:16 (none) snort[7268]: Suspend threshold: 200
2006:06:30-15:41:16 (none) snort[7268]: Suspend period: 30
2006:06:30-15:41:16 (none) snort[7268]: Enforce TCP State: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Midstream Drop Alerts: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Server Data Inspection Limit: -1
2006:06:30-15:41:16 (none) snort[7268]: Inline-mode options:
2006:06:30-15:41:16 (none) snort[7268]: Inline-mode enabled? (stream4inline): No
2006:06:30-15:41:16 (none) snort[7268]: Sliding Windowsize (window_size): 7000 (max full conn: 1198)
2006:06:30-15:41:16 (none) snort[7268]: Memcap reached method (truncate): Prune
2006:06:30-15:41:16 (none) snort[7268]: Truncate percentage (truncate_percentage): 33
2006:06:30-15:41:16 (none) snort[7268]: DROP out-of-window packets (drop_out_of_window): No
2006:06:30-15:41:16 (none) snort[7268]: DROP data on unestablised session state (drop_data_on_unest): No
2006:06:30-15:41:16 (none) snort[7268]: DROP no tcp-flags on establised packets (drop_no_tcp_on_est): No
2006:06:30-15:41:16 (none) snort[7268]: DROP packet not within session limits (drop_not_in_limits): No
2006:06:30-15:41:16 (none) snort[7268]: DROP ttl evasion (drop_ttl_evasion): No
2006:06:30-15:41:16 (none) snort[7268]: Store/Load state from/to disk: No
2006:06:30-15:41:16 (none) snort[7268]: WARNING /etc/snort/snort.conf(56) => flush_behavior set in config file, using old static flushpoints (0)
2006:06:30-15:41:16 (none) snort[7268]: Stream4_reassemble config:
2006:06:30-15:41:16 (none) snort[7268]: Server reassembly: ACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Client reassembly: ACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Reassembler alerts: ACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Zero out flushed packets: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: Flush stream on alert: INACTIVE
2006:06:30-15:41:16 (none) snort[7268]: flush_data_diff_size: 500
2006:06:30-15:41:16 (none) snort[7268]: Reassembler Packet Preferance : Favor Old
2006:06:30-15:41:16 (none) snort[7268]: Packet Sequence Overlap Limit: -1
2006:06:30-15:41:16 (none) snort[7268]: Flush behavior: Small (activation->dynamic->drop->sdrop->reject->rejectboth->rejectsrc->rejectdst->alert->pass->log
2006:06:30-15:41:21 (none) snort[7268]: Log directory = /var/log/snort
2006:06:30-15:44:11 (none) snort[7268]: Final Flow Statistics
2006:06:30-15:44:11 (none) snort[7268]: Snort exiting
[/SIZE]

This thread was automatically locked due to age.

Parents

0 Frank_H over 18 years ago

Had to delete some enties like these, Alot of them...

[SIZE=1]2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6199 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=10003 type=Limit tracking=src count=1 seconds=120
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5944 type=Limit tracking=src count=1 seconds=900
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5802 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5992 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5831 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5945 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5764 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5996 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5921 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6254 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5929 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6271 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5796 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6343 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5976 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6384 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5922 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6196 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6222 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6282 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5765 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6321 type=Limit tracking=src count=1 seconds=3000
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5930 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6237 type=Limit tracking=src count=1 seconds=1200
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5977 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5951 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5961 type=Limit tracking=src count=1 seconds=1800
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6225 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5794 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5825 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5982 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5914 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5774 type=Limit tracking=src count=1 seconds=1800
[/SIZE]
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Frank_H over 18 years ago

Had to delete some enties like these, Alot of them...

[SIZE=1]2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6199 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=10003 type=Limit tracking=src count=1 seconds=120
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5944 type=Limit tracking=src count=1 seconds=900
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5802 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5992 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5831 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5945 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5764 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5996 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5921 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6254 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5929 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6271 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5796 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6343 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5976 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6384 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5922 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6196 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6222 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6282 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5765 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6321 type=Limit tracking=src count=1 seconds=3000
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5930 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6237 type=Limit tracking=src count=1 seconds=1200
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5977 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5951 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5961 type=Limit tracking=src count=1 seconds=1800
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=6225 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5794 type=Limit tracking=src count=1 seconds=600
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5825 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5982 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5914 type=Limit tracking=src count=1 seconds=300
2006:06:30-15:33:15 (none) snort[4266]: | gen-id=1 sig-id=5774 type=Limit tracking=src count=1 seconds=1800
[/SIZE]
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data