the max limit in BPF filter

["Joseph Chen" <cax0cn () gmail com>]

Hi,list;
My test environment is snort-2.6.1.4, oracle 9.0, RH9.0 and RHEL AS4;
when I try to setup a bpf filter file which has 243 bytes, I got an error:

Jun 16 11:29:50 admin snort[2485]: database: oracle_error: ORA-01401:
inserted value too large for column
Jun 16 11:29:50 admin snort[2485]:         : query: INSERT INTO sensor
(hostname, interface, filter, detail, encoding, last_cid) VALUES ('
124.124.1.24','eth0','not (dst net 122.122.122) and not (dst net 121.121.121)
and not (dst net 20.20.20) and not (dst net 22.22.22) and not (dst net
222.222.222) and not (dst host 111.11.1.1) and  not (dst host
111.111.111.111) ',1,0, 0)
Jun 16 11:29:50 admin snort[2485]: database: Problem obtaining SENSOR ID
(sid) from depsight->sensor

after cheching the source code of snort-2.6.1.4, I found that the limitation
is from the SQL script, which is different from database type:

CREATE TABLE sensor ( sid     SERIAL,
                     hostname    TEXT,
                     interface   TEXT,
                     filter      TEXT,

NOTE THAT: the column of filter is TEXT here, while in MsSQL and Oracle it's
varchar(100), this caused the listed error.

my question is can I modify this setting to avoid the previous errors? does
it have any disadvantage to snort?

thanks,
joseph

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users