[Snort-devel] snort option [-n packet-count ]

ratheesh kannoth ratheesh.ksz at ...2499...
Thu May 22 02:44:30 EDT 2014


Hi list,

I am working on a daq layer implementation. I have zero copy from
driver and will send packet to snort thru daq layer. i have two
questions.

1. what is the advantage of mentioning packet-count ? because  in
Daq_Acquire() function ,  daq layer has to call  the call back
function of snort  and  act on verdict. It is all serial ( one packet
at a time ). ?

2. In DAQ layer, i have to fill   DAQ_PktHdr. i could see that
hdr.egress_index  is filled as -1 in  some implementation (
       like in PF_RING DAQ ). what is its significance ?


-Ratheesh




More information about the Snort-devel mailing list