Re: snort + freebsd tuning

[Michael Sierchio <kudzu () tenebras com>]

John wrote:
> I was just wondering if someone could tell me what this is for.
> sysctl debug.bpf_bufsize (default it 4k)
> does snort override this value, and if not should i be increasing it?

[it's used in sys/net/bpf.c]

This is the size of the hold buffer used for transferring
the bits in the packet from the interface memory.  The
listener only gets awakened when the buffer is full, so I'm
dubious about changing the default value -- actually, I think
they pay me to be skeptical ;-)

Also, applications must use the same size buffer as the kernel
buffer, and this restriction is enforced by the packet filter
code.



-------------------------------------------------------
This SF.net email is sponsored by OSDN developer relations
Here's your chance to show off your extensive product knowledge
We want to know what you know. Tell us and you have a chance to win $100
http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users