Posted by user8446 on Mar 31, 2016; 2:39pm
URL: https://itus.accessinnov.com/Bridge-mode-bugfix-and-performance-improvement-tp561p594.html

Wisiwg -

If you are running the trojan rules replace this line in your cofig:
config detection: search-method ac-nq search-optimize max-pattern-len 20 no_stream_inserts

with this one:
config detection: search-method ac-nq split-any-any search-optimize max-pattern-len 20 no_stream_inserts

You're over the ~4500 rule limit for the ac full pattern matcher.

Reference: http://manual.snort.org/node16.html


Hans -

Thanks for throwing together that little script for us!