3.0 server crash

Russell Fulton r.fulton at auckland.ac.nz
Thu Oct 11 20:30:13 EDT 2007


ummm.... I meant to ask does argus use the ring buffer if /PCAP_FRAMES/
is set?

(to get snort to use it you need to set /PCAP_FRAMES/=32K )

Russell

Russell Fulton wrote:
> Carter Bullard wrote:
>   
>> Hey Russell,
>> Does it crash?  Or does it exit?  Or does it work, but just prints the
>> message?
>> Argus doesn't use PF_INET anywhere, so it maybe the libpcap library?
>>
>>     
> installed the newest MMAP version of libpcap from
> http://public.lanl.gov/cpw/ and all behaves as it should now.
>
> Russell
>
>   



More information about the argus mailing list