[Snort-users] How many IP addresses can a variable hold?

Matt Kettler mkettler at ...4108...
Fri Jan 24 15:04:04 EST 2003

There are severe, and exponentiating penalties for increasing numbers of 
comma delimited entries in a IP address specifier.

However, there are no penalties for use of masks. So it's not a function of 
the number if IP's, but the number of range specifiers.

Last I heard more than 4 was considered "bad" for performance.

At 02:32 PM 1/24/2003 -0800, spy guy wrote:
>In snort.conf, how many IP addresses can a variable hold?
>Will there be a performance impact if I have too many? (as in over 100)

More information about the Snort-users mailing list