Snort mailing list archives
Re: Host Attribute table minimum?
From: Russ via Snort-users <snort-users () lists snort org>
Date: Fri, 24 May 2019 11:20:06 -0400
On 5/23/19 3:00 PM, B B via Snort-users wrote:
No. 32 is the minimum maximum. You can load zero or more up to the maximum, and the maximum will be at least 32. If you try to configure the maximum to 31, eg, you will get an error:Hello,I am trying to run down why Snort on pfSense errors out and will not import and use a host attribute table.In the Snort manual I found this:config max_attribute_hosts: <hosts> Sets a limit on the maximum number of hosts to read from the attribute table. Minimum value is 32 and the maximum is 524288 (512k). The default is 10000. If the number of hosts in the attribute table exceeds this value, an error is logged and the remainder of the hosts are ignored. This option is only supported with a Host Attribute TableDoes this mean if you use the max_attribute_hosts setting that less than 32 will cause an error?
ERROR: detect-min.conf(265) max_atttribute_hosts: Invalid number of hosts 31'. Must be between 32 and 524288.
Fatal Error, Quitting..
Thanks Bill _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Host Attribute table minimum? B B via Snort-users (May 23)
- Re: Host Attribute table minimum? Russ via Snort-users (May 25)