Recommended daq pcap bpf buffer size?

[elof () sentor se]

1)
What bpf buffer size do snort ask for at startup?
...or doesn't it ask for anything at all, but simply use the system OS 
default bpf buffer size?


2)
Should this buffersize be tweaked manually?
An example I found on the Internet:

snort --daq pcap --daq-var buffer_size=536870912

Asking for a 512MB bpf buffer seem a bit excessive.
What is a "good" value to use? Someone wrote that 10MB is enough.

/Elof

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!