Maximum Number Of IPs Per Variable In snort.conf

["O'Sullivan, Mairtin" <mairtin.osullivan () imperial ac uk>]

Apologies if this comes through two times. I sent it a few days ago from
an account which wasn't a member of Snort-Users.

I was wondering what's the maximum number of IPs you can have in a
variable in snort.conf?

In the post below it states that the performance hit would be too great
to even attempt introducing a large number of IPs. Has that changed
since 2002?
http://archives.neohapsis.com/archives/snort/2002-12/0600.html

At present I was to look at putting roughly 300 /32 addresses into a
single variable.

They addresses are not consecutive and so can't be supernetted.

Any thoughts?


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users