[Snort-users] HTTP_SERVERS variable length

Andrew R. Baker andrewb at ...950...
Fri Dec 27 14:43:02 EST 2002


Steven Rudolph wrote:
> How long can the var for HTTP_SERVERS be?
> Where would I find this in the code?
> I need a length of about 2000 characters as I have about 150 HTTP 
> servers that are in my network.

Without looking at the code, I recall that the parser has a limit of 
8192 characters per line *after* variable expansion.  So, you should 
still be safe running with a 2000 character variable definition.  My 
suggestion is to try it and if you have any problems (other than 
possible performance issues already noted), let us (the snort team) know 
by sending an e-mail to snort-devel at lists.sourceforge.net and we will 
look into fixing it.

-A





More information about the Snort-users mailing list