[Snort-users] FW: Snort_232_Build12_Installer.exe

Jeremy Hewlett jh at ...1935...
Wed Mar 16 08:29:52 EST 2005


On Wed, Mar 16, Lee Clemens wrote:
> Any hints as to what a good number may be to increase it to for the -current
> rule-set(s)?

You don't need to set the flowbits in 2.3.2. The default setting in
the code is at 64 (which yields 512 unique flowbits IDs). 

> Will it impact performance to have it set too high? Not higher enough?

There will be some impact if you go overboard with flowbits, but it
shouldn't be crippling.






More information about the Snort-users mailing list