[Snort-users] Snort rules maximum rules per file

Hussein Bahaidarah husseinb at ...11827...
Sat Jun 25 13:39:18 EDT 2011


Hello,

Is there a limit on the number of rules support by snort in general? and on per file basis? I have customized a file with 942099 rules and it took about 15 minutes to start snort; but no alerts or actions wer fired.

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
942099 Snort rules read
    942099 detection rules
    0 decoder rules
    0 preprocessor rules
942099 Option Chains linked into 1 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

+-------------------[Rule Port Counts]---------------------------------------
|             tcp     udp    icmp      ip
|     src       0       0       0       0
|     dst  942099       0       0       0
|     any       0       0       0       0
|      nc       0       0       0       0
|     s+d       0       0       0       0
+----------------------------------------------------------------------------
-- 
Regards,
Hussein Bahaidara
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110625/16e0b445/attachment.html>


More information about the Snort-users mailing list