PF ring support in argus

[Peter Van Epp]

On Fri, Oct 12, 2007 at 10:12:23AM -0400, Carter Bullard wrote:
> Hey Russell,
> I looked around, and I don't think there is anything that argus needs  
> to do
> for you to have it use a pf_ring as a packet source.
> 
> Peter's been using rings for a long time, and I don't think he has had
> to make any argus changes?  You do need to make some kernel changes
> but I don't think argus needs to know about that.
> 
> Carter
> 

	Thats true with PF-ring from the ntop author, but Russell is using the
one from lbl which I haven't tried yet (its on the list but time is lacking
and PF-ring is working :-)). The ntop pf-ring replaces the libpcap interface
with one of its own and is transparent to applications, I'd expect the lbl 
one to be similar but it may take a parameter for how big you want the internal
buffers (my PF-ring gets that from the kernel module load command).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada