[Snort-users] Snort 2.9, RHEL 5 and afpacket DAQ
mikelococo at ...11827...
Wed Oct 20 14:19:36 EDT 2010
On 10/20/2010 01:35 PM, Eoin Miller wrote:
> afpacket is nearly identical to mmap'd libpcap. Just give afpacket a
> bigger buffer and the performace should be extremely comprable, and you
> don't have to use super old libpcap anymore.
I think what Ralf is asserting, and Rich and confirming, is that buffer
sizes larger than ~50MB are failing with afpacket (but not with the
Woods patches)... so it is not (yet) possible to use a comparable buffer
size for some unknown reason.
More information about the Snort-users