[Snort-users] PF_RING question

Dennis Henderson hendo at ...3663...
Thu Jun 23 06:09:42 EDT 2005


 

> -----Original Message-----
> From: Milani Paolo [mailto:Paolo.Milani at ...3258...] 
> Sent: Thursday, June 23, 2005 5:14 AM
> To: snort-users at lists.sourceforge.net; hendo at ...3663...
> Subject: RE: [Snort-users] PF_RING question
> 
> Hi dennis,
> 
> I think I can answer your question.
> 
> The size of the buffers for packets in the ring buffer is set 
> as a module option when inserting the module, as an example:
> 
> insmod ring.o bucket_len=1514
> 
> See the readme in the kernel directory of the ring tar.gz for 
> info on other module options.
> 
> User side options like tcpdump -s cannot make you sample more 
> data than has been made available kernel side.
> 
> Paolo Milani



Your suggestion was spot on!

Thanks.  












 Snort-users mailing list
> Snort-users at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-users
> 
> 
> End of Snort-users Digest
> 
> 
> 
> 
> Gruppo Telecom Italia - Direzione e coordinamento di Telecom 
> Italia S.p.A.
> 
> ====================================================================
> CONFIDENTIALITY NOTICE
> This message and its attachments are addressed solely to the 
> persons above and may contain confidential information. If 
> you have received the message in error, be informed that any 
> use of the content hereof is prohibited. Please return it 
> immediately to the sender and delete the message. Should you 
> have any questions, please send an e_mail to 
> MailAdmin at ...13220... Thank you 
> ====================================================================
> 





More information about the Snort-users mailing list