<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#ffffff">
    I'll be removing this maximum value restriction on the next
    version.  It was there to keep people from shooting themselves in
    the foot on 32-bit machines with limited low memory, but it's
    probably not worth the headache it is causing.<br>
    <br>
    On 10/20/2010 03:03 PM, beenph wrote:
    <blockquote
      cite="mid:AANLkTi=2PPSQDG8GugX2vOWqrBf0_FGhUyDWnAhLSyfE@...11828..."
      type="cite">
      <div>In daq_afpacket.c there is a #define  which people who would
        like to set bigger buffer might want to take a look.</div>
      <div> </div>
      <div>#define AF_PACKET_MAX_BUFFER_SIZE   128<br>
        <br>
        <SNIP></div>
      <div>  for (entry = config->values; entry; entry =
        entry->next)<br>
            {<br>
              <strong>  if (!strcmp(entry->key, "<font
            color="#ff0000">buffer_size_mb</font>"))<br>
                     <font color="#ff0000"> size_str = entry->value</font>;<br>
        </strong>        else if (!strcmp(entry->key, "debug"))<br>
                    debug = 1;<br>
            }<br>
      </div>
      <div>    /* Fall back to the environment variable. */<br>
            if (!size_str)<br>
                size_str = getenv("AF_PACKET_BUFFER_SIZE");</div>
      <div><br>
            if (size_str && strcmp("max", size_str) != 0)<br>
            {<br>
                size = strtoul(size_str, NULL, 10);<br>
                if (size > AF_PACKET_MAX_BUFFER_SIZE)<br>
             <font color="#ff0000">  <strong>     size =
            AF_PACKET_MAX_BUFFER_SIZE;<br>
          </strong></font>    }<br>
        <strong>   </strong><font color="#ff0000"><strong> else<br>
                    size = AF_PACKET_MAX_BUFFER_SIZE;<br>
          </strong></font></div>
      <div>    /* The size is specified in megabytes. */<br>
            size = size * 1024 * 1024;</div>
      <div><br>
        </SNIP><br>
      </div>
      <div class="gmail_quote">On Wed, Oct 20, 2010 at 2:19 PM, Mike
        Lococo <span dir="ltr"><<a moz-do-not-send="true"
            href="mailto:mikelococo@...11827...">mikelococo@...11827...</a>></span>
        wrote:<br>
        <blockquote style="border-left: 1px solid rgb(204, 204, 204);
          margin: 0px 0px 0px 0.8ex; padding-left: 1ex;"
          class="gmail_quote">
          <div class="im">On 10/20/2010 01:35 PM, Eoin Miller wrote:<br>
            > afpacket is nearly identical to mmap'd libpcap. Just
            give afpacket a<br>
            > bigger buffer and the performace should be extremely
            comprable, and you<br>
            > don't have to use super old libpcap anymore.<br>
            <br>
          </div>
          I think what Ralf is asserting, and Rich and confirming, is
          that buffer<br>
          sizes larger than ~50MB are failing with afpacket (but not
          with the<br>
          Woods patches)... so it is not (yet) possible to use a
          comparable buffer<br>
          size for some unknown reason.<br>
          <br>
          Cheers,<br>
          <font color="#888888">Mike Lococo<br>
          </font>
          <div>
            <div class="h5"><br>
------------------------------------------------------------------------------<br>
              Nokia and AT&T present the 2010 Calling All
              Innovators-North America contest<br>
              Create new apps & games for the Nokia N8 for consumers
              in  U.S. and Canada<br>
              $10 million total in prizes - $4M cash, 500 devices,
              nearly $6M in marketing<br>
              Develop with Nokia Qt SDK, Web Runtime, or Java and
              Publish to Ovi Store<br>
              <a moz-do-not-send="true"
                href="http://p.sf.net/sfu/nokia-dev2dev" target="_blank">http://p.sf.net/sfu/nokia-dev2dev</a><br>
              _______________________________________________<br>
              Snort-users mailing list<br>
              <a moz-do-not-send="true"
                href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a><br>
              Go to this URL to change user options or unsubscribe:<br>
              <a moz-do-not-send="true"
                href="https://lists.sourceforge.net/lists/listinfo/snort-users"
                target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
              Snort-users list archive:<br>
              <a moz-do-not-send="true"
                href="http://www.geocrawler.com/redir-sf.php3?list=snort-users"
                target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br>
            </div>
          </div>
        </blockquote>
      </div>
      <br>
      <pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store 
<a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/nokia-dev2dev">http://p.sf.net/sfu/nokia-dev2dev</a></pre>
      <pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></pre>
    </blockquote>
    <br>
  </body>
</html>