[Bro-Dev] #447: Bro snaplen

[Bro Tracker]

#447: Bro snaplen
----------------------+--------------------
  Reporter:  vern     |      Owner:
      Type:  Problem  |     Status:  new
  Priority:  Normal   |  Milestone:  Bro1.6
 Component:  Bro      |    Version:
Resolution:           |   Keywords:
----------------------+--------------------

Comment (by vern):

 To first order, I don't get why we'd want this to be user-settable.  Bro
 doesn't work right unless it gets full packets.  There's a *tuning*
 question about how to achieve full packets without wasting kernel memory,
 but what we'd really like is for the configure process to figure out how
 to set that, rather than expecting the user to know how.  (Sure, gurus
 might want to set it.  But they will be very rare.)

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/447#comment:6>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker