Re: I've just noticed that my linux snort is no longer using PCAP_FRAMES ???

[Phil Wood <cpw () lanl gov>]

PCAP_FRAMES is only understood by the libpcap at:

  http://public.lanl.gov/cpw/libpcap-0.9.8.20081128.tar.gz

As far as I know the latest libpcap at tcpdump.org is libpcap-1.1.1.  It
has source code to use a ring buffer but I have not had time to try it
out.  For all I know, it could be the default.  But, I don't think they
went so far as to use my PCAP_FRAMES gimmick.

Later,

-- 
C. Philip Wood, Int. D.
Senior Member of the Internet
Los Alamos National Laboratory
Key fingerprint: 2BB7 A990 44F5 EF4B 4E35  8635 1205 97D3 F6D8 7F39
E-mail: cpw () lanl gov, cornett () arpa net
Phone: 505 667-2598

Attachment: signature.asc
Description: This is a digitally signed message part

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users