[Bro] napatech nt4e-4t

Ghost Pepper ghostpepper007 at gmail.com
Mon Mar 4 08:55:16 PST 2013


I'm affraid I'm out of my league on the nonblocking issue.  I see
references to pcap_getnonblock and pcap_setnonblock in the pcap.h file
provided with the Napatech Software Suite.  Beyond that, at the moment I'm
not sure how to investigate further.  I may use pf_ring as an immediate
solution, and communicate with the Npulse team in the longer term, unless
of course someone saves the day with stories of success.

Thanks for your feedback!






On Mon, Mar 4, 2013 at 9:15 AM, Seth Hall <seth at icir.org> wrote:

>
> On Mar 1, 2013, at 12:56 PM, Ghost Pepper <ghostpepper007 at gmail.com>
> wrote:
>
> > Does anyone know if bro-ids capturing from a napatech card is known not
> to work?
> > I've successfully compiled against the napatech provided libpcap, and
> ldd shows linkage to
> > /opt/napatech3/lib/{ libpcap.so.1, libntapi.so, libntos.so }
>
> I've never heard that anyone has tried.  Does their libpcap wrapper
> support the nonblocking functionality in libpcap?  There are relatively few
> applications that use libpcap in nonblocking mode so it's certainly
> possible that they haven't implemented it.
>
>   .Seth
>
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro-ids.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130304/53caadbe/attachment.html 


More information about the Bro mailing list