Re: [snort flowbits]: how many tags can I use?

["Joel Esler (jesler)" <jesler () cisco com>]

What are you trying to accomplish?  I apologize, but reading your email below, I am thinking you want to record traffic 
after an alert.  Is that right?



On Jul 13, 2016, at 10:29 PM, Maxim <hittlle () 163 com<mailto:hittlle () 163 com>> wrote:

Hi all,
I wanna use flowbits in all my rules to capture bidirectional packets belonging to the same session/flow, so I need to 
put keyword flowbits in each rule. I wonder how many tags can I use? Are there any constraints there?  Here is an 
example of my rule

              alert any any -> any 80 (sid: 10000001; msg:"test-flowbits"; flow: from_client; flowbits: isnotset, 
10000001; flowbits: set, 10000001; rev:1;)

As you can see I'll use sid as the tag there. I wonder if there are any constraints there about the number of tags I 
can use in snort configuration. Many thanks.

Hittlle



------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!