[Snort-devel] snort option [-n packet-count ]
ratheesh.ksz at ...2499...
Thu May 22 02:44:30 EDT 2014
I am working on a daq layer implementation. I have zero copy from
driver and will send packet to snort thru daq layer. i have two
1. what is the advantage of mentioning packet-count ? because in
Daq_Acquire() function , daq layer has to call the call back
function of snort and act on verdict. It is all serial ( one packet
at a time ). ?
2. In DAQ layer, i have to fill DAQ_PktHdr. i could see that
hdr.egress_index is filled as -1 in some implementation (
like in PF_RING DAQ ). what is its significance ?
More information about the Snort-devel