[Bro-Dev] Ticket #447 and default snaplen

Tritium Cat tritium.cat at gmail.com
Thu Aug 2 01:13:23 PDT 2012


I noticed #447 but found a default of 8192 still being used from
"share/bro/base/init-bare.bro", line 2793.

Using a value of "0" results in an error for libpcap

==== stderr.log
fatal error: /usr/local/3rd-party/bro/bin/bro: problem with interface eth5
- pcap_compile(): snaplen of 0 rejects all packets


65535 is accepted:

==== stderr.log
listening on eth5, capture length 65535 bytes
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20120802/466ddbd7/attachment.html 


More information about the bro-dev mailing list