RE: [Snort-inline-users] IpTables IPQ error message

[Gould, S. <sg...@go...>]

Thank you Will.  I did some more investigating with some good and bad
results.

The ip_queue_maxlen value doesn't seem to respect changes made in my
build of Red Hat Enterprise Linux.  Looks like a fix was included in
RHEL 3 Update 4 though. =20

After more digging I found some other values that I could tune that
might help, and low and behold the problem is fixed.  I'll still patch
what I have to so I can modify the ip_queue_maxlen. =20

I changed about 4 or 5 other things and when I narrow down exactly which
one or ones it was that fixed I'll post for the lists.

Thanks again for the point I the right direction.

Scott
-----Original Message-----
From: Will Metcalf [mailto:wil...@gm...]=20
Sent: Thursday, December 30, 2004 11:55 PM
To: Gould, Scott
Cc: sno...@li...
Subject: Re: [Snort-inline-users] IpTables IPQ error message

Sounds like a busy inline sensor try the following.....

echo 2048 > /proc/sys/net/ipv4/ip_queue_maxlen

Regards,

Will


On Thu, 30 Dec 2004 17:21:36 -0500, Gould, Scott <sg...@go...>
wrote:
> Anyone ever seen this:
> =20
> IpqLoop: : Failed to receive netlink message: No buffer space
available
> One of my inline sensors was spitting this out in it's process log.
> =20
> Scott
>