Re: Host Attribute table minimum?

[Russ via Snort-users <snort-users () lists snort org>]

On 5/23/19 3:00 PM, B B via Snort-users wrote:
> Hello,
> I am trying to run down why Snort on pfSense errors out and will not 
> import and use a host attribute table.
> In the Snort manual I found this:
>
> config max_attribute_hosts: <hosts> 	Sets a limit on the maximum 
> number of hosts to read from the attribute table. Minimum value is 32 
> and the maximum is 524288 (512k). The default is 10000. If the number 
> of hosts in the attribute table exceeds this value, an error is logged 
> and the remainder of the hosts are ignored. This option is only 
> supported with a Host Attribute Table
>
>
>
> Does this mean if you use the max_attribute_hosts setting that less 
> than 32 will cause an error?
No.  32 is the minimum maximum.  You can load zero or more up to the 
maximum, and the maximum will be at least 32.  If you try to configure 
the maximum to 31, eg, you will get an error:

ERROR: detect-min.conf(265) max_atttribute_hosts: Invalid number of 
hosts 31'.  Must be between 32 and 524288.
Fatal Error, Quitting..
> Thanks
> Bill
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
>         snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette