[Snort-sigs] FLOWBITS ERROR

Brian bmc at ...95...
Thu Mar 3 12:31:36 EST 2005


On Wed, Mar 02, 2005 at 09:35:48AM +0000, Zultan  wrote:
> I tried Matthew Watchinski's suggestion and set "config
> flowbits_size: 64" and that fixed the problem.
> 
> I just guessed when choosing 64. What is the number for?  Meg of
> memory allocated?

The value was an arbitrary nubmer that fixes your issue.  Anything
bigger than the number of flowbits you have would solve your issue.

flowbits uses a dynamically sized bitarray for data storage.  The more
unique flowbits you have, the larger the bit array you store, however
the storage is only 1 bit per flowbit (rounded up to the nearest
byte).

The original code I wrote that added flowbits didn't include this
arbitrary cap, since if you need the flowbits you need the flowbits.

Its trivial to remove the arbitrary cap.  If you are really concerned,
go hack the code to remove the upper limit.  You won't break anything
by toasting the upper limit.

Brian




More information about the Snort-sigs mailing list