[Snort-devel] where can i change the lenght of variable that i use in snort.conf

Martin Roesch roesch at ...402...
Tue Jan 22 13:43:03 EST 2002

Well, if you *really* want to (and it's an extremely bad idea, your
Snort performance is going to completely suck because it's going to
spend all its time traversing IP lists) the code is in rules.c.

Is this all non-contiguous address space?  It sounds to me like you
either need to have a bigger CIDR block or more Snort sensors, unless
you're working with a really small network this kind of configuration
won't work.


Martin Roesch - Founder/CEO, Sourcefire Inc. - (410)552-6999
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch at ...402... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org

More information about the Snort-devel mailing list