Virtual Memory exceeded

[Vern Paxson]

> We've got some trouble with bro...
> After about 2 hours running bro (mt script), bro crash with a :
> "Virtual Memory exceeded in 'new'" Error.

How large a volume traffic stream are you monitoring?  (how many hosts,
connections/sec, raw link speed)  What filter (bro -F) are you using?

> Can someone suggest me what I can do about this (I've already increased
> RAM and swap from 32Mb to 64Mb) ?

For our environment (5000+ hosts, FDDI link) we run with a lot more memory
than that.

> Is there a way to check what part of bro is taking whole this memory (stream
> buffers or active sessions table, ...)

It will mostly be the active sessions.

		Vern