[Snort-users] How many IP addresses can a variable hold?

Erek Adams erek at ...950...
Fri Jan 24 14:51:04 EST 2003

On Fri, 24 Jan 2003, spy guy wrote:

> In snort.conf, how many IP addresses can a variable hold?
> Will there be a performance impact if I have too many? (as in over 100)

I'm not sure on the max w/o checking the code.  I'll look later tonight.

As for performance:  If you have any sort of traffic, it will be horrid.
You _really_ should use CIDR notation and try to aggregate those IP's into
useable subnets.  Consider this:

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "Evil Access"; content:

If HOME_NET is set as it makes one check:  Is this src ip
inside of the range?

If it's set as ',,, ...' then
it has to check: Is this src ip or or ... and so on.
Aggregate as much as you can, you'll save a lot of headaches, cpu cycles,
and a lot of typing.  :)

Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

More information about the Snort-users mailing list