[Bro] Fwd: Bro's snap length

Will baxterw3232 at gmail.com
Fri Jan 13 09:45:47 PST 2012


Just wondering what the final decision was for snaplen in 2.0?

I did notice that broargs looks to have been deprecated.

-will
---------- Forwarded message ----------
From: "Robin Sommer" <robin at icir.org>
Date: Nov 18, 2011 2:08 PM
Subject: Re: [Bro-Dev] Bro&apos;s snap length
To: "Seth Hall" <seth at icir.org>
Cc: "bro-dev at bro-ids.org Dev" <bro-dev at bro-ids.org>


On Fri, Nov 18, 2011 at 14:34 -0500, you wrote:

> We're going to need to change Bro's default snap length before the 2.0
> final release or at least do something.

I think we should add a script-level option snaplen and set it to a
much smaller default, like 8K or 4K. Plus a FAQ entry, linked from the
Quickstart guide, explaining what's going on and what to do.

Robin

--
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org
_______________________________________________
bro-dev mailing list
bro-dev at bro-ids.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20120113/f55067ae/attachment.html 


More information about the Bro mailing list