[Oisf-users] HTTP Sessions and resource estimation

[Yasha Zislin]

Can you explain what it is? and how it affect memory utilization?
Thanks.

> Date: Thu, 19 Mar 2015 09:29:12 -0700
> From: cnelson at ucsd.edu
> To: coolyasha at hotmail.com; oisf-users at lists.openinfosecfoundation.org
> Subject: Re: [Oisf-users] HTTP Sessions and resource estimation
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I think that is too high a stream reassembly depth.  Try 1mb instead.
> 
> On 3/19/2015 7:19 AM, Yasha Zislin wrote:
> > 
> > My stream reassembly depth is set to 20mb. I forget why it is so high,
> > but I've made it to minimize packet loss.
> > 
> > I am monitoring two span ports (about 1gig each) and my 40 logical
> > CPUs/140 gigs of RAM server is using 95% of RAM.
> > I thought Suricata was able to handle 10 gig feeds. Just trying to
> > understand what I am doing wrong.
> > 
> > Thanks.
> > 
> 
> 
> - -- 
> Cooper Nelson
> Network Security Analyst
> UCSD ACT Security Team
> cnelson at ucsd.edu x41042
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (MingW32)
> 
> iQEcBAEBAgAGBQJVCvlYAAoJEKIFRYQsa8FWfkEH/A5wcqI4JLfh1z6G9cZZurQ2
> logjLwur4bMJgFi5VurAV9+PeyGv7Sqc4fd82CvYZbznhxQ93hGEYS1ObnhYaGRt
> woMTGYbbGs+9tTAb0nhZ9g2LsvosFJnjkW34TmAblgedEGEkSYtm0s5yN5H33RyB
> 32T4J/ivwV07d6GmgHugpKFEaNJq/nJXkUFrRzIKI9/sRiD68yUjqX0+5Gt4F74P
> 1d6uVcRW630KtHFsHwVmbZ3wTuGovgFPCt/NfunVPPp+f/RB7G/LRFhxJaEUp9Ee
> USR+4f2lG3SR2M6AM4lHnw0RFcQJSJ4IugrOZrUzwKUww/7C/01vYsOmbzJJLlw=
> =Y+55
> -----END PGP SIGNATURE-----
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150319/36d3aea0/attachment-0002.html>