[Oisf-users] Memory Allocations

[Yasha Zislin]

I am having issues with Suricata crashing due to running out of memory.I just wanted to clarify certain sections of config that I am doing my calculations correctly. 
max-pending-packets 65000           ------- Does that use a lot of Ram?
So for defrag and flow sections, whatever memcap values I set, that's what the maximum that can be used, correct?
Stream section is a bit unclear to me. Memcap for Stream and Memcap for Reassembly, how do they relate? Which one should be bigger?
Host section, once again, memcap is the maximum RAM that would be used?
And lastly, libhtp section, request and response -body-limit values, is that maximum memory utilization of LIBHTP?
Thanks.


 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20141117/10fa78e7/attachment.html>