[Snort-users] Host Attribute table minimum?

Russ rucombs at cisco.com
Fri May 24 11:20:06 EDT 2019

On 5/23/19 3:00 PM, B B via Snort-users wrote:
> Hello,
> I am trying to run down why Snort on pfSense errors out and will not 
> import and use a host attribute table.
> In the Snort manual I found this:
> config max_attribute_hosts: <hosts> 	Sets a limit on the maximum 
> number of hosts to read from the attribute table. Minimum value is 32 
> and the maximum is 524288 (512k). The default is 10000. If the number 
> of hosts in the attribute table exceeds this value, an error is logged 
> and the remainder of the hosts are ignored. This option is only 
> supported with a Host Attribute Table
> Does this mean if you use the max_attribute_hosts setting that less 
> than 32 will cause an error?
No.  32 is the minimum maximum.  You can load zero or more up to the 
maximum, and the maximum will be at least 32.  If you try to configure 
the maximum to 31, eg, you will get an error:

ERROR: detect-min.conf(265) max_atttribute_hosts: Invalid number of 
hosts 31'.  Must be between 32 and 524288.
Fatal Error, Quitting..
> Thanks
> Bill
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 	To unsubscribe, send an email to:
> 	snort-users-leave at lists.snort.org
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20190524/a19810db/attachment.html>

More information about the Snort-users mailing list