[Snort-users] Mmapped Capture on Linux

Mike Lococo mikelococo at ...11827...
Wed Aug 11 18:36:23 EDT 2010


Hi Folks,

I'm interested to know if anyone has attempted to do mmaped capture with
snort using the stock libpcap distribution.  The manual still references
Phil Woods rather old patches based on libpcap-0.9.8, and all of the
web/mailing-list references I can find use that or various other old
patches.

According to the CHANGES file that ships with libpcap, it has supported
memory-mapped capture on linux since 1.0.0:


http://github.com/mcr/libpcap/blob/3c13ac2cc3e06899a8ed1aca3e88b2abebb02c9a/CHANGES

Russ Combs recently suggested that snort has support for it in recent
releases:

  http://seclists.org/snort/2010/q3/66

I'm having trouble finding documentation or any evidence of folks using
this feature though.  Does it require configuration to enable, or is it
automatic as long as the kernel, libpcap, and snort version all support
it?  Is there a way to test and confirm that mmapped capture is being
used on a given snort instance?

Cheers,
Mike Lococo




More information about the Snort-users mailing list