Brian Caswell bmc at ...95...
Tue Mar 1 19:32:38 EST 2005

On Mar 1, 2005, at 10:05 PM, Matt Jonkman wrote:
> A question for the snort folks, is this threshold for performance or 
> memory consumption, or both? And will we have to look at upping that 
> for future releases as flowbits is more used? Or are we abusing 
> flowbits?

Mostly just memory consumption.  Though, I don't think the limit should 
be so small.

Are the bleeding rules using flowbits?


More information about the Snort-sigs mailing list