access to user data buffer

[Peter Van Epp]

On Wed, Feb 21, 2007 at 11:46:54PM +0000, poncenby smythe wrote:
> greetings,
> 
> my argus.conf includes the following:
> ARGUS_CAPTURE_DATA_LEN=1024
> 
> my .rarc includes the following:
> RA_USERDATA_ENCODE=Ascii
> 
<snip>

	From an experiment earlier today I think the limit is 256. I set 
-U 512 (up from -U 256) but the maximum capture buffer I saw on ra was less
than 256 (although that may have been operator error). Pfring is set to 
capture the entire packet if asked (and will on tcpdump) so it shouldn't have
been a libpcap issue I don't think. 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada