[Bro] Bro's snap length

Siwek, Jonathan Luke jsiwek at illinois.edu
Fri Jan 13 10:05:24 PST 2012

> Just wondering what the final decision was for snaplen in 2.0?

    * Reduced snaplen default from 65535 to old default of 8192. The
      large value was introducing performance problems on many

    * Replaced the --snaplen/-l command line option with a
      scripting-layer option called "snaplen". The new option can also
      be redefined on the command line, e.g. ``bro -i eth0

There's also a related ticket slated for 2.1 that would help with the problems encountered at large snaplens:



More information about the Bro mailing list