Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » Snort Advanced » Maximum rules accepted by SNORT 2.3.3

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Maximum rules accepted by SNORT 2.3.3


Posted by RJ1 on July 17, 2005 21:26:08

Hi there,

I am currently testing the capability of Snort 2.3.3 in handling a huge ruleset. I loaded 50,000 rules, Snort runs as usual, I fire some known attacks but Snort didnt detect anything. I reduced the rules until Snort produced some alerts, that is about 16,000 rules.

Anyway, I did the testing because I couldnt find any documentation regarding this matter. Anybody have any answer to this or maybe have done similar testing? Any URL or pointer to the answer will be appreciated..

Cheers from Kuala Lumpur, Malaysia!
-RJ1-
site feedback | Terms of Use | Privacy Policy | forum archives ©2007 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.