[Snort-users] Snort 2.9, RHEL 5 and afpacket DAQ

Mike Lococo mikelococo at ...11827...
Wed Oct 20 14:19:36 EDT 2010

On 10/20/2010 01:35 PM, Eoin Miller wrote:
> afpacket is nearly identical to mmap'd libpcap. Just give afpacket a 
> bigger buffer and the performace should be extremely comprable, and you 
> don't have to use super old libpcap anymore.

I think what Ralf is asserting, and Rich and confirming, is that buffer
sizes larger than ~50MB are failing with afpacket (but not with the
Woods patches)... so it is not (yet) possible to use a comparable buffer
size for some unknown reason.

Mike Lococo

More information about the Snort-users mailing list