Snort mailing list archives
snort option [-n packet-count ]
From: ratheesh kannoth <ratheesh.ksz () gmail com>
Date: Thu, 22 May 2014 12:14:30 +0530
Hi list, I am working on a daq layer implementation. I have zero copy from driver and will send packet to snort thru daq layer. i have two questions. 1. what is the advantage of mentioning packet-count ? because in Daq_Acquire() function , daq layer has to call the call back function of snort and act on verdict. It is all serial ( one packet at a time ). ? 2. In DAQ layer, i have to fill DAQ_PktHdr. i could see that hdr.egress_index is filled as -1 in some implementation ( like in PF_RING DAQ ). what is its significance ? -Ratheesh ------------------------------------------------------------------------------ "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE Instantly run your Selenium tests across 300+ browser/OS combos. Get unparalleled scalability from the best Selenium testing platform available Simple to use. Nothing to install. Get started now for free." http://p.sf.net/sfu/SauceLabs _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- snort option [-n packet-count ] ratheesh kannoth (May 21)
- Re: snort option [-n packet-count ] Steve Sturges (ststurge) (May 22)
- Re: snort option [-n packet-count ] ratheesh kannoth (May 22)
- Re: snort option [-n packet-count ] Steven Sturges (May 22)
- Re: snort option [-n packet-count ] ratheesh kannoth (May 22)
- Re: snort option [-n packet-count ] Steve Sturges (ststurge) (May 22)