<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Can you explain what it is? and how it affect memory utilization?<div><br></div><div>Thanks.<br><br><div>> Date: Thu, 19 Mar 2015 09:29:12 -0700<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] HTTP Sessions and resource estimation<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> I think that is too high a stream reassembly depth. Try 1mb instead.<br>> <br>> On 3/19/2015 7:19 AM, Yasha Zislin wrote:<br>> > <br>> > My stream reassembly depth is set to 20mb. I forget why it is so high,<br>> > but I've made it to minimize packet loss.<br>> > <br>> > I am monitoring two span ports (about 1gig each) and my 40 logical<br>> > CPUs/140 gigs of RAM server is using 95% of RAM.<br>> > I thought Suricata was able to handle 10 gig feeds. Just trying to<br>> > understand what I am doing wrong.<br>> > <br>> > Thanks.<br>> > <br>> <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> <br>> iQEcBAEBAgAGBQJVCvlYAAoJEKIFRYQsa8FWfkEH/A5wcqI4JLfh1z6G9cZZurQ2<br>> logjLwur4bMJgFi5VurAV9+PeyGv7Sqc4fd82CvYZbznhxQ93hGEYS1ObnhYaGRt<br>> woMTGYbbGs+9tTAb0nhZ9g2LsvosFJnjkW34TmAblgedEGEkSYtm0s5yN5H33RyB<br>> 32T4J/ivwV07d6GmgHugpKFEaNJq/nJXkUFrRzIKI9/sRiD68yUjqX0+5Gt4F74P<br>> 1d6uVcRW630KtHFsHwVmbZ3wTuGovgFPCt/NfunVPPp+f/RB7G/LRFhxJaEUp9Ee<br>> USR+4f2lG3SR2M6AM4lHnw0RFcQJSJ4IugrOZrUzwKUww/7C/01vYsOmbzJJLlw=<br>> =Y+55<br>> -----END PGP SIGNATURE-----<br></div></div> </div></body>
</html>