Snort mailing list archives
Re: PCAP_FRAMES
From: samk () twinix com
Date: Thu, 21 May 2009 12:16:23 -0500 (CDT)
See Thread at: http://www.techienuggets.com/Detail?tx=73563 Posted on behalf of a User To set PCAP_FRAMES, and assuming you are using a BASH shell, simply set the variable in your .bashrc file or, export it from the commandline, thusly; export PCAP_FRAMES=32768 Then, call snort with whatever parameters you normally use. Hope this helps. In Response To: --_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, I'm using Phil Woods MMAP-mode libpcap, and just put more memory in my snor= t machine. To take advantage of that, I tried using PCAP_MEMORY instead of= PCAP_FRAMES=3Dmax, but when I do that, snort is logging "Not Using PCAP_FR= AMES". Do you have to use PCAP_FRAMES with snort instead of PCAP_MEMORY? Thanks, Shawn --_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
<meta name=3D"Generator" content=3D"Microsoft Exchange Server"> <!-- converted from rtf --> <style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left:= #800000 2px solid; } --></style> </head> <body> <font face=3D"Arial, sans-serif" size=3D"3"> <div>Hi,</div> <div><font face=3D"Times New Roman, serif"> </font></div> <div>I’m using Phil Woods MMAP-mode libpcap, and just put more memory= in my snort machine. To take advantage of that, I tried using PCAP_M= EMORY instead of PCAP_FRAMES=3Dmax, but when I do that, snort is logging &#= 8220;Not Using PCAP_FRAMES”. Do you have to use PCAP_FRAMES with snort instead of PCAP_MEMORY?</div> <div><font face=3D"Times New Roman, serif"> </font></div> <div>Thanks,</div> <div>Shawn</div> <div><font face=3D"Times New Roman, serif"> </font></div> </font> </body> </html> --_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_-- ------------------------------------------------------------------------------ Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise -Strategies to boost innovation and cut costs with open source participation -Receive a $600 discount off the registration fee with the source code: SFAD http://p.sf.net/sfu/XcvMzF8H _______________________________________________ Snort-users mailing list Snort-noway () spam com Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------------------------------ Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT is a gathering of tech-side developers & brand creativity professionals. Meet the minds behind Google Creative Lab, Visual Complexity, Processing, & iPhoneDevCamp as they present alongside digital heavyweights like Barbarian Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: PCAP_FRAMES samk (May 26)