[Bro] Bro's snap length
Siwek, Jonathan Luke
jsiwek at illinois.edu
Fri Jan 13 10:05:24 PST 2012
> Just wondering what the final decision was for snaplen in 2.0?
* Reduced snaplen default from 65535 to old default of 8192. The
large value was introducing performance problems on many
systems.
* Replaced the --snaplen/-l command line option with a
scripting-layer option called "snaplen". The new option can also
be redefined on the command line, e.g. ``bro -i eth0
snaplen=65535``.
There's also a related ticket slated for 2.1 that would help with the problems encountered at large snaplens:
http://tracker.bro-ids.org/bro/ticket/553
+Jon
More information about the Bro
mailing list