[Snort-users] PF_RING question
hendo at ...3663...
Thu Jun 23 06:09:42 EDT 2005
> -----Original Message-----
> From: Milani Paolo [mailto:Paolo.Milani at ...3258...]
> Sent: Thursday, June 23, 2005 5:14 AM
> To: snort-users at lists.sourceforge.net; hendo at ...3663...
> Subject: RE: [Snort-users] PF_RING question
> Hi dennis,
> I think I can answer your question.
> The size of the buffers for packets in the ring buffer is set
> as a module option when inserting the module, as an example:
> insmod ring.o bucket_len=1514
> See the readme in the kernel directory of the ring tar.gz for
> info on other module options.
> User side options like tcpdump -s cannot make you sample more
> data than has been made available kernel side.
> Paolo Milani
Your suggestion was spot on!
Snort-users mailing list
> Snort-users at lists.sourceforge.net
> End of Snort-users Digest
> Gruppo Telecom Italia - Direzione e coordinamento di Telecom
> Italia S.p.A.
> CONFIDENTIALITY NOTICE
> This message and its attachments are addressed solely to the
> persons above and may contain confidential information. If
> you have received the message in error, be informed that any
> use of the content hereof is prohibited. Please return it
> immediately to the sender and delete the message. Should you
> have any questions, please send an e_mail to
> MailAdmin at ...13220... Thank you
More information about the Snort-users