[Snort-users] pfring-daq-module

Lawrence R. Hughes, Sr. lhughes at ...14822...
Wed Dec 12 12:05:24 EST 2012


Thanks Russ.. Can you please tell me who wrote the code for the daq-2.0.0?


  ----- Original Message ----- 
  From: Russ Combs 
  To: snort-sers ; lhughes at ...14822... 
  Sent: Wednesday, December 12, 2012 9:56 AM
  Subject: Fwd: pfring-daq-module


  Luca usually responds to questions about the PFRING DAQ.

  If you are having performance issues with Snort 294 we will need more info like CPU usage, profiling stats, etc. but it looks like you need to rule out DAQ issues first.


  ---------- Forwarded message ----------
  From: Joel Esler <jesler at ...1935...>
  Date: Tue, Dec 11, 2012 at 6:48 PM
  Subject: Re: pfring-daq-module
  To: "Lawrence R. Hughes, Sr." <lhughes at ...14822...>
  Cc: safwat fahmy <safwat.fahmy at ...14822...>, "<bugs at ...950...>" <bugs at ...979...950...>



  Unfortunately Larry, I can't troubleshoot this for you by myself.  I try to answer as many emails as I can, but I can't get to them all.  


  Cc'ing bugs at ...950... where this stuff should go.  


  --
  Joel Esler
  Sent from my iPhone 

  On Dec 11, 2012, at 6:00 PM, "Lawrence R. Hughes, Sr." <lhughes at ...14852.....> wrote:


    Joel,

    We downloaded the following pfring-daq-module from your site:


    PFRING External DAQ
    Made popular by Luca Deri, Sourcefire’s Michael Altizer ported Luca’s PFRING DAQ Module to the above framework.

    pfring-daq-module-0.1.tar.gz

    It does not appear to be compatible with NTOP's latest release of PF_Ring 5.5.1 and daq-2.0.0 or snort-2.9.4

    We want to use the pf_ring module with snort 2.9.4 but PF_Ring 5.5.1 is giving us major packet drops?

    We were using an earlier version of PF_Ring with daq-0.6.2 and snort-2.9.3.1 and had zero packet drops running at 900meg (packet gen)?

    Another fallback, is the new pfring-daq-module does not allow br0 while in inline mode it requires: eth0:eth1

    Is this problem with snort-2.9.4?

    Please help us out on this please?

    Thanks,

    Larry












-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121212/94dfa62d/attachment.html>


More information about the Snort-users mailing list