[Snort-users] Snort as Gigabit Sensor

Chris Green cmg at ...1935...
Thu Jul 31 15:06:07 EDT 2003


Frank Knobbe <frank at ...9761...> writes:
>
> Touche. Still didn't answer my question though :)  How much buffering
> occurs in libpcap?

That's implementation depedent between drivers, cards, and pcaps. Peg
tcpdump-workers at ...4097... when you want to help find out.  Not a lot
is typically done at pcap though there are exceptions.

The real answer:

never as much as you would want.  Separating them out might be a fun
project for someone and separating out the stuff that happens before
the InterfaceThread from the things that happen in the pcap_loop
callback and comparing.
-- 
Chris Green <cmg at ...1935...>
A watched process never cores.




More information about the Snort-users mailing list