Why do we a limit of 60 for ip reputations in Suricata?

The maximum value for the category ID is hard coded at 60 currently. Curious, how did we come up with this number, and what are the potential consequences of increasing this number in our setup? Any suggestions on the testing that we should if we choose to increase this number from 60 to let’s say 200.

The SReputation struct that is stored per IP (in our Host object) in the reputation list is exactly 64 bytes this way. Growing it will increase memory usage and slightly increase lookup cost. I don’t think there should be additional side effects.

1 Like