<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I've changed the depth to 2mb and it didnt help. My memory utilization is the same.<div><br></div><div><br><br><div>> Date: Thu, 19 Mar 2015 11:22:16 -0700<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] HTTP Sessions and resource estimation<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> Say you have lots of customers watching streaming video over HTTP (like<br>> Netflix). Each video stream will ultimately consume 20MB of memory<br>> before suricata stops tracking it and releases the memory.<br>> <br>> I also do a bit of performance analysis for HTTP proxy/cache design and<br>> it turns out that the vast majority (over 99%) of HTTP objects are under<br>> 1 MB in size, so you really aren't getting much from tracking past that.<br>> I understand that TCP connections are often left open and recycled, but<br>> most 'interesting' packets from a network security perspective are going<br>> to be within the first MB of new flows. In fact, most of the ET HTTP<br>> sigs (other than the WEB_CLIENT sigs) will only trigger against the<br>> first few packets, if at all.<br>> <br>> - -Coop<br>> <br>> On 3/19/2015 10:54 AM, Yasha Zislin wrote:<br>> > Can you explain what it is? and how it affect memory utilization?<br>> > <br>> > Thanks.<br>> > <br>> >> Date: Thu, 19 Mar 2015 09:29:12 -0700<br>> >> From: cnelson@ucsd.edu<br>> >> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> >> Subject: Re: [Oisf-users] HTTP Sessions and resource estimation<br>> >><br>> > I think that is too high a stream reassembly depth. Try 1mb instead.<br>> > <br>> > On 3/19/2015 7:19 AM, Yasha Zislin wrote:<br>> > <br>> >> My stream reassembly depth is set to 20mb. I forget why it is so high,<br>> >> but I've made it to minimize packet loss.<br>> > <br>> >> I am monitoring two span ports (about 1gig each) and my 40 logical<br>> >> CPUs/140 gigs of RAM server is using 95% of RAM.<br>> >> I thought Suricata was able to handle 10 gig feeds. Just trying to<br>> >> understand what I am doing wrong.<br>> > <br>> >> Thanks.<br>> > <br>> > <br>> > <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> <br>> iQEcBAEBAgAGBQJVCxPYAAoJEKIFRYQsa8FWfEwH/2hgwdAkdj3eL+DarFDweMLC<br>> n7EWdYzpgBG3J01Fod8l8zk7lrv5GpzkHHq9seZq9AnCStfky1zYku0dor8JibvN<br>> 4XTKdqMlLludYgkRqXpH9P09qp7dhZru+qNtFHEKT9M2Vb3LYbE9iAAF58HjcRMk<br>> ffWAMKh7ojJLfIRH8M8zHpnyj0/+LDfJR6Rze5D/gKSI3SD17bO6ztO+hMhJnbq2<br>> bKEGPOF4MHGyG/EVMV0LU+wivUa9QkJAPP3FlgAJE5YKfPULve5ZZGYF5kKt87T7<br>> j9iJMIP2V8TCtlK4bPMDm17lzn4b1VAMN/eFGTspvEKkcEM1Y1PC+VXdgp/utPU=<br>> =m6pY<br>> -----END PGP SIGNATURE-----<br></div></div> </div></body>
</html>