[Oisf-users] Max. allowed value for flow.hash-size

[fatema bannatwala]

Hi,

I wanted to verify what's the maximum allowed value for flow.hash-size
variable in suricata.yaml?

According to the docs, it's default value is 65536, but I had it set to
655360 based on some older suggestions from the group.
Does the flow.hash-size has the same restriction as for other hash_size
variables in pattern-matcher? :

*The hash_size option determines the size of the hash-table that is
internal used by the pattern matcher. A low hash-size (small table) causes
lower memory usage, but decreases the performance. The opposite counts for
a high hash-size: higher memory usage, but (generally) higher performance.
The memory settings for hash size of the algorithms can vary from lowest
(2048) - low (4096) - medium (8192) - high (16384) - higher (32768) – max
(65536). (Higher is ‘highest’ in YAML 1.0 -1.0.2)*

Thanks,
Fatema
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20200713/d8a35e2a/attachment.html>