Snort mailing list archives

Re: PCAP_FRAMES

From: samk () twinix com
Date: Thu, 21 May 2009 12:16:23 -0500 (CDT)

See Thread at: http://www.techienuggets.com/Detail?tx=73563 Posted on behalf of a User

To set PCAP_FRAMES, and assuming you are using a BASH shell, simply set the variable in your .bashrc file or, export it 
from the commandline, thusly;

export PCAP_FRAMES=32768

Then, call snort with whatever parameters you normally use.

Hope this helps.

In Response To: 

--_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

I'm using Phil Woods MMAP-mode libpcap, and just put more memory in my snor=
t machine.  To take advantage of that, I tried using PCAP_MEMORY instead of=
 PCAP_FRAMES=3Dmax, but when I do that, snort is logging "Not Using PCAP_FR=
AMES".  Do you have to use PCAP_FRAMES with snort instead of PCAP_MEMORY?

Thanks,
Shawn


--_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=

<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left:=
 #800000 2px solid; } --></style>
</head>
<body>
<font face=3D"Arial, sans-serif" size=3D"3">
<div>Hi,</div>
<div><font face=3D"Times New Roman, serif">&nbsp;</font></div>
<div>I&#8217;m using Phil Woods MMAP-mode libpcap, and just put more memory=
 in my snort machine.&nbsp; To take advantage of that, I tried using PCAP_M=
EMORY instead of PCAP_FRAMES=3Dmax, but when I do that, snort is logging &#=
8220;Not Using PCAP_FRAMES&#8221;.&nbsp; Do you have to use PCAP_FRAMES
with snort instead of PCAP_MEMORY?</div>
<div><font face=3D"Times New Roman, serif">&nbsp;</font></div>
<div>Thanks,</div>
<div>Shawn</div>
<div><font face=3D"Times New Roman, serif">&nbsp;</font></div>
</font>
</body>
</html>

--_000_D05BDFB6A6F4EE43ABE62D1A7170AF3703461343HEXBCFMBVS01exc_--

------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
_______________________________________________
Snort-users mailing list
Snort-noway () spam com
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


------------------------------------------------------------------------------
Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT 
is a gathering of tech-side developers & brand creativity professionals. Meet
the minds behind Google Creative Lab, Visual Complexity, Processing, & 
iPhoneDevCamp as they present alongside digital heavyweights like Barbarian 
Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com 
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread:

Re: PCAP_FRAMES samk (May 26)