[Snort-users] Details on using offset

setests setests setests at ...11827...
Fri Jul 26 08:24:38 EDT 2013


Hi

What happens when we have very large value for offset something of the
order of 8000 bytes would it impact the snort's performance ?  Currently
the max offset which I could see is around 1010 bytes.

$grep offset rules/* | sed 's/offset:/\noffset:/' | grep ^offset | cut
-d";" -f1 | sort -unr -t":" -k2
offset:1010
offset:1000
offset:525
offset:512
offset:432
offset:392
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130726/8ef874e3/attachment.html>


More information about the Snort-users mailing list