PF ring support in argus

[Carter Bullard]

Hey Russell,
We don't have any specific support for ring buffers, so if we  need
to do something, we should do it now.  I'll take a look at snort to
see if they are doing something interesting.

Carter


On Oct 11, 2007, at 8:30 PM, Russell Fulton wrote:

> ummm.... I meant to ask does argus use the ring buffer if / 
> PCAP_FRAMES/
> is set?
>
> (to get snort to use it you need to set /PCAP_FRAMES/=32K )
>
> Russell
>
> Russell Fulton wrote:
>> Carter Bullard wrote:
>>
>>> Hey Russell,
>>> Does it crash?  Or does it exit?  Or does it work, but just  
>>> prints the
>>> message?
>>> Argus doesn't use PF_INET anywhere, so it maybe the libpcap library?
>>>
>>>
>> installed the newest MMAP version of libpcap from
>> http://public.lanl.gov/cpw/ and all behaves as it should now.
>>
>> Russell
>>
>>
>