[Snort-sigs] FLOWBITS ERROR

Matt Jonkman matt at ...2436...
Wed Mar 2 05:40:16 EST 2005


Same here. I had assumed the default was 128 as is in the example in the 
manual, but I'm guessing not. Must have been 32.

A feature request:
With flowbits becoming more used and valuable, can we have snort dump on 
startup the number of unique set's that are laoded from the ruleset? 
Otherwise figuring out where you stand will be tedious when tuning rulesets.

Thanks

matt

Zultan wrote:
> I tried Matthew Watchinski's suggestion and set "config flowbits_size: 64" and that fixed the problem.
> 
> I just guessed when choosing 64. What is the number for?  Meg of memory allocated?





More information about the Snort-sigs mailing list