Item: stream.tcp_cache.idle_timeout
Ignacio Serrano via Snort-users <[email protected]> Tue, 19 Mar 2024 15:10:29 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <DM4P220MB0842F2B48A22BACC709C84729A2C2@DM4P220MB0842.NAMP220.PROD.OUTLOOK.COM> |
Hello! I have Snort 3.1.81.0 installed on ubuntu 22.04. I wanted to ask about the following item: stream.tcp_cache.idle_timeout = 3600: maximum inactive time before retiring session tracker I'm not understanding why this number is so large by default (3600), as it keeps sessions held and releases them one hour later. This causes it to consume 100% of the RAM. If I lower it to 180 (like UDP), it works normally. Do you have any idea why it has such a high default value? I'm behind a firewall, so it could leave sessions unanswered. Thank you very much, and greetings to all. Sorry for my writing. _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette