[Oisf-users] Max number of flows/flowints

Victor Julien lists at inliniac.net
Tue Oct 18 09:11:24 UTC 2016

On 18-10-16 07:56, Amin Saba wrote:
> Are there any artificial limits on the maximum number of flows an
> instance of suricata can handle?

The only limit is your flow.memcap setting or your available memory,
which ever comes first.

Performance will depend on your hash table size.

> What about the number of flowbits/flowints defined over those flows?

This is only limited by available memory.

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list