[Bro-Dev] #447: Bro snaplen

Bro Tracker bro at tracker.bro-ids.org
Fri Jun 3 10:52:14 PDT 2011

#447: Bro snaplen
  Reporter:  vern     |      Owner:
      Type:  Problem  |     Status:  new
  Priority:  Normal   |  Milestone:  Bro1.6
 Component:  Bro      |    Version:
Resolution:           |   Keywords:

Comment (by vern):

 To first order, I don't get why we'd want this to be user-settable.  Bro
 doesn't work right unless it gets full packets.  There's a *tuning*
 question about how to achieve full packets without wasting kernel memory,
 but what we'd really like is for the configure process to figure out how
 to set that, rather than expecting the user to know how.  (Sure, gurus
 might want to set it.  But they will be very rare.)

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/447#comment:6>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list