This will merge rules more aggressively so that the engine is only processing those that can actually match.
Memory is cheap. People with little memory should not run suricata anyways.
Signed-off-by: Michael Tremer michael.tremer@ipfire.org --- config/suricata/suricata.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index dc1163820..10dbdc99b 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -745,7 +745,7 @@ decoder: # If the argument specified is 0, the engine uses an internally defined # default limit. On not specifying a value, we use no limits on the recursion. detect: - profile: medium + profile: high custom-values: toclient-groups: 3 toserver-groups: 25