Actions
Feature #3887
closedyaml: Increase maximum size for address vars
Effort:
Difficulty:
Label:
Description
It appears the maximum length for an address var is 8192 bytes0 when dynamically generating lists for vars in large networks, it is easy to exceed this limit (especially with IPv6 network ranges). Can this be increased?
The only current workaround I'm aware of is to try to dynamically split lists and generate multiple vars which is... a bit unruly
[0] https://github.com/OISF/suricata/blob/master/src/detect-engine-address.c#L746
Actions