[Bro-Dev] [JIRA] (BIT-553) Script variable to set pcap's buffer size

Seth Hall (JIRA) jira at bro-tracker.atlassian.net
Thu Nov 7 07:52:31 PST 2013


     [ https://bro-tracker.atlassian.net/browse/BIT-553?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Seth Hall updated BIT-553:
--------------------------

    Resolution: Feedback Missing
        Status: Closed  (was: Open)

I don't think we're going to bother with this especially since packet capture might get overhauled a bit soon.

> Script variable to set pcap's buffer size
> -----------------------------------------
>
>                 Key: BIT-553
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-553
>             Project: Bro Issue Tracker
>          Issue Type: New Feature
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: gregor
>             Fix For: 2.2
>
>
> Newer pcap versions have a pcap_set_buffer_size(). This call can be used to adjust the kernel level buffer size for captures. (E.g., Linux PF_RING's buffer size, which will be quite important if we start using 64KB snaplen)
> It's supported for all platforms we care about (Linux, BPF-based OSes), but we probably want to make sure that it obsoletes the manual tuning through:
> http://www.net.t-labs.tu-berlin.de/research/bpcs/
> (It might well be that one still has to manually increase the max buffer sizes)



--
This message was sent by Atlassian JIRA
(v6.2-OD-01#6204)


More information about the bro-dev mailing list