[Oisf-users] Max. allowed value for flow.hash-size

[Victor Julien]

On 14-07-2020 03:39, fatema bannatwala wrote:
> I wanted to verify what's the maximum allowed value for flow.hash-size
> variable in suricata.yaml?

It is a u32 underneath, so you can go up to 4GiB.

> According to the docs, it's default value is 65536, but I had it set to
> 655360 based on some older suggestions from the group.
> Does the flow.hash-size has the same restriction as for other hash_size
> variables in pattern-matcher? :
> 
> /The hash_size option determines the size of the hash-table that is
> internal used by the pattern matcher. A low hash-size (small table)
> causes lower memory usage, but decreases the performance. The opposite
> counts for a high hash-size: higher memory usage, but (generally) higher
> performance. The memory settings for hash size of the algorithms can
> vary from lowest (2048) - low (4096) - medium (8192) - high (16384) -
> higher (32768) – max (65536). (Higher is ‘highest’ in YAML 1.0 -1.0.2)/
> /

These are not related. This is also outdated, I'm updating the user
guide to remove it.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------