<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>So after some testing I was negating two subnets before including a big one.<div>Suricata would never complete loading. It would run out of RAM (server has 128gb or so) and crash.</div><div>It would get stuck on Building signature grouping structure.</div><div>Stage 2 would take an hour and stage 3 would never complete.</div><div>As soon as I've removed negated subnets, the whole thing took 5 minutes to load.</div><div><br></div><div>Any thoughts?</div><div><br></div><div>Thank you.<br><br><div><hr id="stopSpelling">Date: Tue, 29 Sep 2015 20:23:31 +0000<br>From: coolyasha@hotmail.com<br>To: rmkml@yahoo.fr<br>CC: oisf-users@lists.openinfosecfoundation.org<br>Subject: Re: [Oisf-users] HOMENET question<br><br>
<p dir="ltr">Good to know. Another question. <br>
If i monitor two interfaces via pfring, can i have separate homenets for each interface?
</p>
<p dir="ltr">Thanks <br>
</p>
<br>
<br>
<br>
<div class="ecxgmail_quote">On Tue, Sep 29, 2015 at 12:34 PM -0700, "rmkml" <span dir="ltr">
<<a href="mailto:rmkml@yahoo.fr" target="_blank">rmkml@yahoo.fr</a>></span> wrote:<br>
<br>
</div>
<div class="ecxBodyFragment">
<div class="PlainText">Hi Yasha,<br>
<br>
Yes please negate subnet first.<br>
<br>
Regards<br>
@Rmkml<br>
<br>
<br>
On Tue, 29 Sep 2015, Yasha Zislin wrote:<br>
<br>
> Question about HOMENET.<br>
> Can we exclude subnets from a bigger subnet?<br>
> For example,<br>
> HOME_NET: "[10.0.0.0/8,!10.1.0.0/16]"<br>
> <br>
> Is that possible?<br>
> <br>
> Thanks<br>
> <br>
></div>
</div>
<br>_______________________________________________
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net</div></div> </div></body>
</html>