Symptom

Snort stuck at RX ring full causing health status to become RED. And it will stuck there even if the traffic has cleared.

Conditions

a lot of fragments of big IP packets (IP packet length over 2000 bytes is considered big).

Workaround

Remove big IP packets in the traffic.

Further Problem Description