[9.171][ANSWERED] Snort error: Session exceeded configured max bytes to queue

Using the default IPS patterns in 9.171, I'm seeing:

2013:11:28-21:42:57 fw snort[13394]: S5: Session exceeded configured max bytes to queue 1048576 using 1062960 bytes (server queue). 192.168.11.13 60303 --> 192.168.13.10 80 (0) : LWstate 0x9 LWFlags 0x6007

This occurred while doing some Iperf tests.

Let me know if more info is needed.

Barry

Parents

0 lmatt over 11 years ago

After long discussion we decided to not increase configured bytes.
If a box is underload, and it exceeds the limits - then this "helps" speed up that stream.

If it exceed, the traffic will not be blocked ...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 lmatt over 11 years ago

After long discussion we decided to not increase configured bytes.
If a box is underload, and it exceeds the limits - then this "helps" speed up that stream.

If it exceed, the traffic will not be blocked ...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data