<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
I'll be removing this maximum value restriction on the next
version. It was there to keep people from shooting themselves in
the foot on 32-bit machines with limited low memory, but it's
probably not worth the headache it is causing.<br>
<br>
On 10/20/2010 03:03 PM, beenph wrote:
<blockquote
cite="mid:AANLkTi=2PPSQDG8GugX2vOWqrBf0_FGhUyDWnAhLSyfE@...11828..."
type="cite">
<div>In daq_afpacket.c there is a #define which people who would
like to set bigger buffer might want to take a look.</div>
<div> </div>
<div>#define AF_PACKET_MAX_BUFFER_SIZE 128<br>
<br>
<SNIP></div>
<div> for (entry = config->values; entry; entry =
entry->next)<br>
{<br>
<strong> if (!strcmp(entry->key, "<font
color="#ff0000">buffer_size_mb</font>"))<br>
<font color="#ff0000"> size_str = entry->value</font>;<br>
</strong> else if (!strcmp(entry->key, "debug"))<br>
debug = 1;<br>
}<br>
</div>
<div> /* Fall back to the environment variable. */<br>
if (!size_str)<br>
size_str = getenv("AF_PACKET_BUFFER_SIZE");</div>
<div><br>
if (size_str && strcmp("max", size_str) != 0)<br>
{<br>
size = strtoul(size_str, NULL, 10);<br>
if (size > AF_PACKET_MAX_BUFFER_SIZE)<br>
<font color="#ff0000"> <strong> size =
AF_PACKET_MAX_BUFFER_SIZE;<br>
</strong></font> }<br>
<strong> </strong><font color="#ff0000"><strong> else<br>
size = AF_PACKET_MAX_BUFFER_SIZE;<br>
</strong></font></div>
<div> /* The size is specified in megabytes. */<br>
size = size * 1024 * 1024;</div>
<div><br>
</SNIP><br>
</div>
<div class="gmail_quote">On Wed, Oct 20, 2010 at 2:19 PM, Mike
Lococo <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:mikelococo@...11827...">mikelococo@...11827...</a>></span>
wrote:<br>
<blockquote style="border-left: 1px solid rgb(204, 204, 204);
margin: 0px 0px 0px 0.8ex; padding-left: 1ex;"
class="gmail_quote">
<div class="im">On 10/20/2010 01:35 PM, Eoin Miller wrote:<br>
> afpacket is nearly identical to mmap'd libpcap. Just
give afpacket a<br>
> bigger buffer and the performace should be extremely
comprable, and you<br>
> don't have to use super old libpcap anymore.<br>
<br>
</div>
I think what Ralf is asserting, and Rich and confirming, is
that buffer<br>
sizes larger than ~50MB are failing with afpacket (but not
with the<br>
Woods patches)... so it is not (yet) possible to use a
comparable buffer<br>
size for some unknown reason.<br>
<br>
Cheers,<br>
<font color="#888888">Mike Lococo<br>
</font>
<div>
<div class="h5"><br>
------------------------------------------------------------------------------<br>
Nokia and AT&T present the 2010 Calling All
Innovators-North America contest<br>
Create new apps & games for the Nokia N8 for consumers
in U.S. and Canada<br>
$10 million total in prizes - $4M cash, 500 devices,
nearly $6M in marketing<br>
Develop with Nokia Qt SDK, Web Runtime, or Java and
Publish to Ovi Store<br>
<a moz-do-not-send="true"
href="http://p.sf.net/sfu/nokia-dev2dev" target="_blank">http://p.sf.net/sfu/nokia-dev2dev</a><br>
_______________________________________________<br>
Snort-users mailing list<br>
<a moz-do-not-send="true"
href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a moz-do-not-send="true"
href="https://lists.sourceforge.net/lists/listinfo/snort-users"
target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a moz-do-not-send="true"
href="http://www.geocrawler.com/redir-sf.php3?list=snort-users"
target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br>
</div>
</div>
</blockquote>
</div>
<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
<a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/nokia-dev2dev">http://p.sf.net/sfu/nokia-dev2dev</a></pre>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></pre>
</blockquote>
<br>
</body>
</html>