[Oisf-users] memcap drops etc

Victor Julien lists at inliniac.net
Thu Dec 6 11:10:18 UTC 2012

On 12/06/2012 11:17 AM, Christophe Vandeplas wrote:
> Almost all my IDSses are having
> tcp.segment_memcap_drop

Affected only by available memory and stream.reassembly.memcap (reducing
stream.reassembly.depth can reduce the mem use per stream, so that may
affect it as wel)

> tcp.reassembly_gap

Affected by tcp.segment_memcap_drop, bad checksums and packet loss.

In general it means pkts are missing or have been rejected for
reassembly (e.g. bad csum)

> And some of them have
> tcp.ssn_memcap_drop

Affected by:
available memory

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list