[Oisf-users] memcap drops etc

[Victor Julien]

On 12/06/2012 11:17 AM, Christophe Vandeplas wrote:
> Almost all my IDSses are having
> tcp.segment_memcap_drop

Affected only by available memory and stream.reassembly.memcap (reducing
stream.reassembly.depth can reduce the mem use per stream, so that may
affect it as wel)

> tcp.reassembly_gap

Affected by tcp.segment_memcap_drop, bad checksums and packet loss.

In general it means pkts are missing or have been rejected for
reassembly (e.g. bad csum)

> 
> And some of them have
> tcp.ssn_memcap_drop

Affected by:
stream.memcap
stream.max-sessions
available memory

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------