Queue size / log limits, max number of events on 1 packet

I have heard (maybe a long while back now) that snort has a limit on how
many rules can fire on a single packet.  I was wondering how accurate this
is, and if it is documented somewhere?

I have been trying to test this, but I'm not sure about the results I am
seeing, as maybe I am doing something wrong.  I have a small pcap and a
large rule set that should fire on the pcap.  It seems that when I run
snort, it fires 8 times on a single packet, which I understand to be the
default.  If I change the default config though, it seems to have no impact
on this.  For example I have this configuration change:

config event_queue: max_queue 20 log 20 order_events content_length

If I comment out the 8 that fired, and run the same pcap again, I find 2
more that had not previously fired.  I guess ideally I would see all 10?
But I am not sure how to enable such a configuration if it is possible to
do so.

Thank you

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette