[Snort-users] How much will a huge list of subnets to the frag3 preprocessor slow snort?

I fairly easily made a script to take a p0f log of my network and turn
it into Windows, Solaris, Linux, BSD, BSD-Left, First, and Last
configuration instructions to the frag3 preprocessor.  But my attempt to
extend it in Perl to consolidate all the IPs into non-overlapping CIDR
ranges has been stymied from the start; I'm not a scripting expert and
I've wasted a week on it.  

How much will it slow down Snort if I just give it a ~4,000 line
snort.conf?  Alternatively, does anyone have a script that does what I
want?

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users