Snort mailing list archives
Re: max flowbits fatal errors
From: Russ Combs <rcombs () sourcefire com>
Date: Thu, 7 Oct 2010 15:23:28 -0400
Looks like that option is broken. I'll create a bug for it. Are building from source? You are so close to the limit, are there any rules you can disable? On Thu, Oct 7, 2010 at 9:55 AM, Kungu Panda <kungupanda () gmail com> wrote:
I am running into the following fatal error when starting snort: "ERROR: FLOWBITS: The number of flowbit IDs in the current ruleset (513) exceed the maximum number of IDs that are allowed (512)." "Fatal Error, Quitting." I tried setting the global configuration option in snort.conf: "config flowbits_size: 768" which really resulted in the really confusing error: "ERROR: /etc/snort/snort.conf Invalid argument to 'flowbits_size': 768. Must be a positive integer and less than 256." Running on snort v2.8.6.1. Tried finding help in the snort manual and README.flowbits with no success. Also did not find any command-line options that would help. Can someone point me in the right direction regarding bumping-up the maximum number of flowbits IDs ? And what exactly does the "config flowbits_size: nnn" configuration option do ? Thank you, K.Panda ------------------------------------------------------------------------------ Beautiful is writing same markup. Internet Explorer 9 supports standards for HTML5, CSS3, SVG 1.1, ECMAScript5, and DOM L2 & L3. Spend less time writing and rewriting code and more time creating great experiences on the web. Be a part of the beta today. http://p.sf.net/sfu/beautyoftheweb _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Beautiful is writing same markup. Internet Explorer 9 supports standards for HTML5, CSS3, SVG 1.1, ECMAScript5, and DOM L2 & L3. Spend less time writing and rewriting code and more time creating great experiences on the web. Be a part of the beta today. http://p.sf.net/sfu/beautyoftheweb
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- max flowbits fatal errors Kungu Panda (Oct 07)
- Re: max flowbits fatal errors Russ Combs (Oct 07)
- Re: max flowbits fatal errors Kungu Panda (Oct 07)
- Re: max flowbits fatal errors Russ Combs (Oct 14)
- Re: max flowbits fatal errors Kungu Panda (Oct 07)
- Re: max flowbits fatal errors Russ Combs (Oct 07)