Re: snort and TNAPI

[Jason Wallace <jason.r.wallace () gmail com>]

I used PF_Ring (without TNAPI) with snort about 2 years ago. I did
some testing comparing it to Phil Wood's libpcap and regular libpcap.
I wasn't impressed with the capture performance of PF_Ring (on x86).
It is really good at capturing very small packets (better than the
other two libpcaps), so it is great for things like ntop. Most of the
stats you see listed on the site are for 64 byte packets. With snort
the snap length is pretty high (at least for me) > 512 bytes.
Supposedly it works better on amd64 systems. I have not used
PF_RING+TNAPI though.


Wally

On Wed, May 20, 2009 at 2:20 PM, Ritter, Nicholas
<Nicholas.Ritter () americantv com> wrote:
> Has anyone started using snort with pf_ring/TNAPI, or have any opinion on
> the subject?
>
>
>
> TNAPI info: http://www.ntop.org/TNAPI.html
>
>
>
>
>
> Nick
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables
> unlimited royalty-free distribution of the report engine
> for externally facing server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables 
unlimited royalty-free distribution of the report engine 
for externally facing server and web deployment. 
http://p.sf.net/sfu/businessobjects
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users