suricata: increase dns flood trigger

on slow lines unbound trigger the floodprotection at init.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index cb7ececb49ae2ca5d59a04c31e38f83db2ddfaa8..54016a88732f2472cc0e9c32d21f38d33d01118d 100644 (file)
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -224,7 +224,7 @@ app-layer:
 
       # How many unreplied DNS requests are considered a flood.
       # If the limit is reached, app-layer-event:dns.flooded; will match.
-      request-flood: 512
+      request-flood: 2048
 
       tcp:
         enabled: yes