[Snort-users] PCAP_FRAMES

samk at ...14587... samk at ...14587...
Thu May 21 13:16:23 EDT 2009


See Thread at: http://www.techienuggets.com/Detail?tx=73563 Posted on behalf of a User

To set PCAP_FRAMES, and assuming you are using a BASH shell, simply set the variable in your .bashrc file or, export it from the commandline, thusly;

export PCAP_FRAMES=32768

Then, call snort with whatever parameters you normally use.

Hope this helps.

In Response To: 

--_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

I'm using Phil Woods MMAP-mode libpcap, and just put more memory in my snor=
t machine.  To take advantage of that, I tried using PCAP_MEMORY instead of=
 PCAP_FRAMES=3Dmax, but when I do that, snort is logging "Not Using PCAP_FR=
AMES".  Do you have to use PCAP_FRAMES with snort instead of PCAP_MEMORY?

Thanks,
Shawn


--_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left:=
 #800000 2px solid; } --></style>
</head>
<body>
<font face=3D"Arial, sans-serif" size=3D"3">
<div>Hi,</div>
<div><font face=3D"Times New Roman, serif"> </font></div>
<div>I’m using Phil Woods MMAP-mode libpcap, and just put more memory=
 in my snort machine.  To take advantage of that, I tried using PCAP_M=
EMORY instead of PCAP_FRAMES=3Dmax, but when I do that, snort is logging &#=
8220;Not Using PCAP_FRAMES”.  Do you have to use PCAP_FRAMES
with snort instead of PCAP_MEMORY?</div>
<div><font face=3D"Times New Roman, serif"> </font></div>
<div>Thanks,</div>
<div>Shawn</div>
<div><font face=3D"Times New Roman, serif"> </font></div>
</font>
</body>
</html>

--_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_--

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
_______________________________________________
Snort-users mailing list
Snort-noway at ...14588...
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list