[Snort-users] Snort as Gigabit Sensor
cmg at ...1935...
Thu Jul 31 15:06:07 EDT 2003
Frank Knobbe <frank at ...9761...> writes:
> Touche. Still didn't answer my question though :) How much buffering
> occurs in libpcap?
That's implementation depedent between drivers, cards, and pcaps. Peg
tcpdump-workers at ...4097... when you want to help find out. Not a lot
is typically done at pcap though there are exceptions.
The real answer:
never as much as you would want. Separating them out might be a fun
project for someone and separating out the stuff that happens before
the InterfaceThread from the things that happen in the pcap_loop
callback and comparing.
Chris Green <cmg at ...1935...>
A watched process never cores.
More information about the Snort-users