[Snort-users] pfring-daq-module

Russ Combs rcombs at ...1935...
Wed Dec 12 17:18:07 EST 2012


On Wed, Dec 12, 2012 at 12:05 PM, Lawrence R. Hughes, Sr. <
lhughes at ...14822...> wrote:

> **
> Thanks Russ.. Can you please tell me who wrote the code for the daq-2.0.0?
>

That would be Sourcefire.

>
>
>
> ----- Original Message -----
> *From:* Russ Combs <rcombs at ...1935...>
> *To:* snort-sers <snort-users at lists.sourceforge.net> ;
> lhughes at ...14822...
> *Sent:* Wednesday, December 12, 2012 9:56 AM
> *Subject:* Fwd: pfring-daq-module
>
> Luca usually responds to questions about the PFRING DAQ.
>
> If you are having performance issues with Snort 294 we will need more info
> like CPU usage, profiling stats, etc. but it looks like you need to rule
> out DAQ issues first.
>
> ---------- Forwarded message ----------
> From: Joel Esler <jesler at ...1935...>
> Date: Tue, Dec 11, 2012 at 6:48 PM
> Subject: Re: pfring-daq-module
> To: "Lawrence R. Hughes, Sr." <lhughes at ...14822...>
> Cc: safwat fahmy <safwat.fahmy at ...14822...>, "<bugs at ...950...>" <
> bugs at ...950...>
>
>
>  Unfortunately Larry, I can't troubleshoot this for you by myself.  I try
> to answer as many emails as I can, but I can't get to them all.
>
> Cc'ing bugs at ...950... where this stuff should go.
>
> --
> *Joel Esler*
> Sent from my iPhone 
>
> On Dec 11, 2012, at 6:00 PM, "Lawrence R. Hughes, Sr." <
> lhughes at ...14822...> wrote:
>
>  Joel,
>
> We downloaded the following pfring-daq-module from your site:
>
>
>  PFRING External DAQ
>
> Made popular by Luca Deri, Sourcefire’s Michael Altizer ported Luca’s
> PFRING DAQ Module to the above framework.
>
> pfring-daq-module-0.1.tar.gz<http://s3.amazonaws.com/snort-org/www/assets/162/pfring-daq-module-0.1.tar.gz>
>
> It does not appear to be compatible with NTOP's latest release of PF_Ring
> 5.5.1 and daq-2.0.0 or snort-2.9.4
>
> We want to use the pf_ring module with snort 2.9.4 but PF_Ring 5.5.1 is
> giving us major packet drops?
>
> We were using an earlier version of PF_Ring with daq-0.6.2 and
> snort-2.9.3.1 and had zero packet drops running at 900meg (packet gen)?
>
> Another fallback, is the new pfring-daq-module does not allow br0 while in
> inline mode it requires: eth0:eth1
>
> Is this problem with snort-2.9.4?
>
> Please help us out on this please?
>
> Thanks,
>
> Larry
>
>
>
>
>
>
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121212/fccd8fcd/attachment.html>


More information about the Snort-users mailing list