Snort mailing list archives
Recommended daq pcap bpf buffer size?
From: elof () sentor se
Date: Tue, 19 Feb 2013 16:54:48 +0100 (CET)
1) What bpf buffer size do snort ask for at startup? ...or doesn't it ask for anything at all, but simply use the system OS default bpf buffer size? 2) Should this buffersize be tweaked manually? An example I found on the Internet: snort --daq pcap --daq-var buffer_size=536870912 Asking for a 512MB bpf buffer seem a bit excessive. What is a "good" value to use? Someone wrote that 10MB is enough. /Elof ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_feb _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Recommended daq pcap bpf buffer size? elof (Feb 19)