Re: [Snort-inline-users] FW: Message from snort_inline 2.0.5

[Dale L. H. <dh...@ni...>]

I was playing with this the other day as well. I found a page (it's 
late, due to brain damage I can't find it tonight) that suggests setting 
the following values to 1 Megabyte:

*/proc/sys/net/core/rmem_default*
*/proc/sys/net/core/rmem_max*

I believe you'll find by inspecting those values, you'll see they are 
set to something like 65535. The page I found said to set them to 
1048576.  I found the following link that may help (it is not the one I 
was working off the other day):

    http://www.lip.pt/computing/cg-services/other-changes.htm



Brian Jameson wrote:

>	I have received the following from snort-inline-2.0.5, 'IpqLoop: : Failed
>to receive netlink message: No buffer space available'. This message is
>displayed on the console as I am currently running inline in non-daemon
>mode. Can anyone enlighten me as to what it means and how I can  prevent it
>in the future?
>	It's just struck me that this test box only has 64meg of RAM and I have not
>enabled the snort low-memory option, would this help?
>regards,
>Brian
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: IBM Linux Tutorials.
>Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
>Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
>Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>
>  
>

-- 
"The trouble with doing something right the first time 
 is that nobody appreciates how difficult it was."

-- Dale L. Handy, P.E.
   dh...@ni...
   http://www.nitrodata.com