[Snort-users] I've just noticed that my linux snort is no longer using PCAP_FRAMES ???
cpw at ...440...
Wed May 12 10:42:44 EDT 2010
PCAP_FRAMES is only understood by the libpcap at:
As far as I know the latest libpcap at tcpdump.org is libpcap-1.1.1. It
has source code to use a ring buffer but I have not had time to try it
out. For all I know, it could be the default. But, I don't think they
went so far as to use my PCAP_FRAMES gimmick.
C. Philip Wood, Int. D.
Senior Member of the Internet
Los Alamos National Laboratory
Key fingerprint: 2BB7 A990 44F5 EF4B 4E35 8635 1205 97D3 F6D8 7F39
E-mail: cpw at ...440..., cornett at ...1649...
Phone: 505 667-2598
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 197 bytes
Desc: This is a digitally signed message part
More information about the Snort-users