[Snort-sigs] FLOWBITS ERROR
bmc at ...95...
Thu Mar 3 12:31:36 EST 2005
On Wed, Mar 02, 2005 at 09:35:48AM +0000, Zultan wrote:
> I tried Matthew Watchinski's suggestion and set "config
> flowbits_size: 64" and that fixed the problem.
> I just guessed when choosing 64. What is the number for? Meg of
> memory allocated?
The value was an arbitrary nubmer that fixes your issue. Anything
bigger than the number of flowbits you have would solve your issue.
flowbits uses a dynamically sized bitarray for data storage. The more
unique flowbits you have, the larger the bit array you store, however
the storage is only 1 bit per flowbit (rounded up to the nearest
The original code I wrote that added flowbits didn't include this
arbitrary cap, since if you need the flowbits you need the flowbits.
Its trivial to remove the arbitrary cap. If you are really concerned,
go hack the code to remove the upper limit. You won't break anything
by toasting the upper limit.
More information about the Snort-sigs